CVE-2026-57948

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57948
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57948.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57948
Published
2026-06-29T17:19:11.989Z
Modified
2026-07-16T03:31:04.405787859Z
Severity
  • 7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
Details

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-1004",
        "CWE-614"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57948.json"
}
References

Affected packages

Git / github.com/pinpoint-apm/pinpoint

Affected ranges

Type
GIT
Repo
https://github.com/pinpoint-apm/pinpoint
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e3940e516c0fc215be990778a6eca01e2274870a
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.0"
        },
        {
            "fixed": "3.1.0"
        }
    ]
}

Affected versions

1.*
1.5.1
1.5.2
1.6.0
1.6.0-RC1
1.6.0-RC2
1.6.1
1.6.1-RC1
1.6.1-RC2
1.7.0
1.7.0-RC1
1.7.0-RC2
1.7.1
1.7.2
1.8.0
1.8.0-RC1
1.8.1
1.8.1-RC1
v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.4.0
v2.4.0-RC1
v2.5.0
v2.5.1
v3.*
v3.0.0
v3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57948.json"