CVE-2026-78188 PUBLISHED

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

Assigner: CPANSec
Reserved: 23.08.2026 Published: 31.10.2026 Updated: 31.10.2026

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.

WebDyne::Session sets its session cookie with only a name, value and path.

Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

Product Status

Package Collection https://cpan.org/modules
Package Name WebDyne
Versions Default: unaffected
  • affected from 2.014 to 3.022 (excl.)

Solutions

Upgrade to WebDyne 3.022 or later. The SameSite attribute also requires CGI::Simple 1.22 or later.

References

Problem Types

  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute CWE
  • CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag CWE
  • CWE-1275 Sensitive Cookie with Improper SameSite Attribute CWE