Session Cookie Vulnerability in WebDyne Product from ASPEER
CVE-2026-78188

Currently unrated

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-78188?

The WebDyne product from ASPEER, specifically versions 2.014 through 3.021, is susceptible to a session cookie vulnerability. The issue arises because the session cookies lack essential attributes—Secure, HttpOnly, and SameSite. Consequently, these cookies are transmitted over plain HTTP, allowing potential interception by network attackers or cross-site scripting exploits. This flaw enables unauthorized access to the session ID, risking user data and integrity. Effective mitigation involves updating to the latest version and implementing proper security measures for session cookies.

References

https://metacpan.org/release/ASPEER/WebDyne-3.022/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.