CVE-2026-57948
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
| CWE | CWE-1004 CWE-614 |
| Vendor | pinpoint-apm |
| Product | pinpoint |
| Published | Jun 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for pinpoint-apm pinpoint
Be the first to know when new medium vulnerabilities affecting pinpoint-apm pinpoint are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
pinpoint-apm / pinpoint
0 ≤ 3.1.0
References
Credits
George Chen