{"id":"CVE-2026-78188","kind":"vulnerability","aliases":["CVE-2026-78188"],"related":[],"title":"WebDyne Perl: session cookies lack Secure, HttpOnly and SameSite flags","description":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.","summary":"WebDyne, a Perl framework for web pages, sets its session cookie without the Secure, HttpOnly or SameSite attributes. An attacker on the network or an injected script can read the session ID and reuse it, and another site can send requests that carry the session.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","web-sessions","webdyne"],"not_affected_if":["no-session-use","static-pages"],"how_to_check":"- Look for the WebDyne version in the Perl dependencies, for example `perl -MWebDyne -e 'print $WebDyne::VERSION'`\n- Check whether the application uses WebDyne::Session and whether the session cookie is set with Secure, HttpOnly and SameSite\n- Check whether the application runs over plain HTTP anywhere","fix":"- WebDyne versions from `2.014` before `3.022`: move to `3.022` or later","status":"open","published_at":"2026-10-31T15:16:53+00:00","first_seen_at":"2026-10-31T15:36:19+00:00","triaged_at":"2026-10-31T15:36:43+00:00","updated_at":"2026-10-31T15:36:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T15:36:43Z","model":"claude-haiku-5-5","output":{"fix":"- WebDyne versions from `2.014` before `3.022`: move to `3.022` or later","reach":"network","title":"WebDyne Perl: session cookies lack Secure, HttpOnly and SameSite flags","impact":"medium","summary":"WebDyne, a Perl framework for web pages, sets its session cookie without the Secure, HttpOnly or SameSite attributes. An attacker on the network or an injected script can read the session ID and reuse it, and another site can send requests that carry the session.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","webdyne","web-sessions"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"session hijacked, attacker acts as the logged-in user","analyst_note":"","how_to_check":"- Look for the WebDyne version in the Perl dependencies, for example `perl -MWebDyne -e 'print $WebDyne::VERSION'`\n- Check whether the application uses WebDyne::Session and whether the session cookie is set with Secure, HttpOnly and SameSite\n- Check whether the application runs over plain HTTP anywhere","plain_action":"","needs_analyst":false,"not_affected_if":["no-session-use","static-pages"],"who_is_affected":"Applications built with WebDyne that use its session handling are affected, since the session cookie is the problem. Sites that only serve static pages or do not use WebDyne::Session are not affected. Any site that serves sessions over plain HTTP or allows cross-site requests carries the most risk.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4167,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-78188':13A,16A '2.014':71C '3.022':73C 'anoth':59B,132C 'attack':42B,122C 'attribut':40B,85C 'browser':99C 'carri':65B,138C 'cooki':4A,33B,78C,91C 'cross':111C 'cross-sit':110C 'cve':11A,14A 'expos':115C 'flag':10A 'framework':26B 'http':107C 'httpon':7A,37B,82C 'id':54B,104C 'inject':48B,125C 'issu':76C 'lack':5A 'make':135C 'name':95C 'network':45B,121C 'packag':17B 'page':29B,118C 'path':98C 'perl':2A,18B,25B,75C 'plain':106C 'read':51B 'request':63B,113C,136C 'reus':56B 'samesit':9A,39B,84C 'script':49B,119C,126C 'secur':6A,36B,81C 'send':62B,101C 'session':3A,21B,32B,53B,67B,77C,87C,90C,103C,130C 'set':30B,88C 'site':60B,112C,133C 'steal':128C 'valu':96C 'version':69C 'web':20B,28B 'web-sess':19B 'webdyn':1A,22B,23B,68C,86C 'without':34B,79C","nicknames":[],"mitigations":[],"who_affected":"Applications built with WebDyne that use its session handling are affected, since the session cookie is the problem. Sites that only serve static pages or do not use WebDyne::Session are not affected. Any site that serves sessions over plain HTTP or allows cross-site requests carries the most risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T15:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78188","severity":null,"published_at":"2026-10-31T15:16:53+00:00","modified_at":"2026-10-31T15:16:53+00:00","first_seen_at":"2026-10-31T15:36:19+00:00","fetched_at":"2026-10-31T15:36:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}