CVE-2026-57948 Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
Attackers can hijack sessions by stealing the pinpointJwt cookie via XSS or sniffing due to missing HttpOnly and Secure attributes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-57948?
CVE-2026-57948 is a high-severity vulnerability in pinpoint-apm pinpoint, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
Which versions are affected by CVE-2026-57948?
How do I fix CVE-2026-57948?
No fix has been published for CVE-2026-57948 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-57948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57948 exists.
Sources
Also known as GHSA-f4g5-7fg3-8rw6.