{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"WebDyne","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"3.022","status":"affected","version":"2.014","versionType":"custom"}]}],"cveId":"CVE-2026-78188","cwes":["CWE-614","CWE-1004","CWE-1275"],"description":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.","epss":{"date":"2026-11-05","percentile":0.02347,"score":0.00127},"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793973073611,"publishedAt":1793457217285,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to WebDyne 3.022 or later. The SameSite attribute also requires CGI::Simple 1.22 or later."}],"revision":"5805e808b27faf1bef8742ca0fa36176b224e2350730c1326cf976a99293e0d1","sources":[{"modifiedAt":1793973073611,"name":"CNA: CPANSec","retrievedAt":1793974253467,"url":"https://www.cve.org/CVERecord?id=CVE-2026-78188"},{"modifiedAt":1793636137080,"name":"NVD","retrievedAt":1793643499109,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78188"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793945212051,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78188"}],"ssvc":{"assessedAt":1793973042577,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes","updatedAt":1793974253467}