CVE-2026-57948

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pinpoint-apm/pinpoint/issues/13858
https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt
https://github.com/pinpoint-apm/pinpoint/issues/13858

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Pinpoint hasta la versión 3.1.0 contiene una vulnerabilidad de gestión de sesión insegura que permite a los atacantes acceder a la cookie de sesión pinpointJwt debido a la ausencia de los atributos HttpOnly y Secure, lo que permite el acceso de JavaScript a través de document.cookie y la transmisión en texto claro sobre HTTP. Los atacantes pueden explotar vulnerabilidades de cross-site scripting almacenadas o reflejadas para exfiltrar el token de sesión o interceptarlo mediante el rastreo de red para realizar secuestro de sesión.

Information

Published : 2026-06-29 18:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-57948

Mitre link : CVE-2026-57948

CVE.ORG link : CVE-2026-57948

JSON object : View

Products Affected

No product.

CWE

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-1004

Sensitive Cookie Without 'HttpOnly' Flag

{"id": "CVE-2026-57948", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57948", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T03:57:12.172783Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/pinpoint-apm/pinpoint", "vendor": "pinpoint-apm", "product": "pinpoint", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.0"}], "packageURL": "pkg:github/pinpoint-apm/pinpoint", "defaultStatus": "unaffected"}]}], "published": "2026-06-29T18:16:39.863", "references": [{"url": "https://github.com/pinpoint-apm/pinpoint/issues/13858", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pinpoint-apm/pinpoint/issues/13858", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-614"}, {"lang": "en", "value": "CWE-1004"}]}], "descriptions": [{"lang": "en", "value": "Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking."}, {"lang": "es", "value": "Pinpoint hasta la versi\u00f3n 3.1.0 contiene una vulnerabilidad de gesti\u00f3n de sesi\u00f3n insegura que permite a los atacantes acceder a la cookie de sesi\u00f3n pinpointJwt debido a la ausencia de los atributos HttpOnly y Secure, lo que permite el acceso de JavaScript a trav\u00e9s de document.cookie y la transmisi\u00f3n en texto claro sobre HTTP. Los atacantes pueden explotar vulnerabilidades de cross-site scripting almacenadas o reflejadas para exfiltrar el token de sesi\u00f3n o interceptarlo mediante el rastreo de red para realizar secuestro de sesi\u00f3n."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "disclosure@vulncheck.com"}