CVE-2026-57948: Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-10-25
Weakness: CWE-614

Description

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.

Affected products

pinpoint-apm pinpoint: through 3.1.0

References

https://github.com/pinpoint-apm/pinpoint/issues/13858
https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt
https://github.com/pinpoint-apm/pinpoint/issues/13858

Get alerted when CVE-2026-57948 or the next vulnerability affects your stack