CVE-2026-78188

Medium

Description

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

SeverityMedium

CVSS5.4

Exploit probability—

ProductWebdyne

PublishedOct 31, 2026

First seenNov 4, 2026

Weakness typeCWE-614CWE-614 CWE-1004CWE-1004 CWE-1275CWE-1275

How to fix

Update

WebDyne3.022 or later

Vendor advisories

metacpan.org/release/ASPEER/WebDyne-3.022/changes

Affected products

Product	Affected versions	Fixed in
WebDyne	2.014 ≤ v < 3.022	3.022

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.