Insecure Session Management in Pinpoint by Pinpoint APM

CVE-2026-57948

What is CVE-2026-57948?

The Pinpoint application, specifically version 3.1.0, is vulnerable due to inadequate session management practices. This vulnerability allows unauthorized access to the pinpointJwt session cookie as it lacks the security attributes 'HttpOnly' and 'Secure'. Consequently, this oversight permits JavaScript-based access to the session cookie through document.cookie, coupled with potential cleartext transmission over HTTP, which can lead to interception by attackers. Exploiting this vulnerability may enable attackers to conduct session hijacking through techniques such as stored or reflected cross-site scripting, or by employing network sniffing to exfiltrate session tokens.

References