Researcher Disclosureissue tracking
https://github.com/pinpoint-apm/pinpoint/issues/13858 CVE-2026-57948
HIGH
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
Record summary
CVE-2026-57948 has a selected CVSS score of 7.6 (high).
Description
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 2, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
pinpointBrowse pinpoint-apm / pinpointDefault status: unaffected | CVE List | Through 3.1.0 | affected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-57948 vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt