CPANSA-WebDyne-2026-78188: WebDyne vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2026-10-31T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2026-10-31T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score Severity
Original language Language en
Also referred to

Vulnerability Description

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.

WebDyne::Session sets its session cookie with only a name, value and path.

Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

Vulnerabilities

CVE-2026-78188

Vulnerability Description

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.

WebDyne::Session sets its session cookie with only a name, value and path.

Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

Weakness CWE-614 : Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Product status

Known affected
Product Score
WebDyne greater than or equal 2.014 and less than 3.022
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
Fixed

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Sat Oct 31 00:00:00 2026 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/