CVE-2026-57948
Medium · 6.8CVSS
6.8
EPSS
0.2%
Published
Jun 29, 2026
CISA due date
—
The record
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115519 Missing security attributes on sensitive cookies in KNIME Business Hub before version… CWE-614
- CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy… CWE-614
- CVE-2026-15656 IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on… CWE-614
- CVE-2026-48058 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. CWE-614
- CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set. CWE-614
- CVE-2026-46550 NocoDB is software for building databases as spreadsheets. CWE-614
- CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid… CWE-614
- CVE-2026-11956 A vulnerability was determined in TwiN gatus 5.36.0. CWE-614