7.6
HIGH CVSS 4.0
CVE-2026-57948
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
Description

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.

INFO

Published Date :

June 29, 2026, 6:16 p.m.

Last Modified :

July 14, 2026, 10:17 p.m.

Remotely Exploit :

Yes !
Affected Products

The following products are affected by CVE-2026-57948 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Pinpoint pinpoint_booking_system
1 Pinpoint-apm pinpoint
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1 MEDIUM 83251b91-4cc7-4094-a5c7-464a1b83ea10
CVSS 3.1 MEDIUM MITRE-CVE
CVSS 3.1 MEDIUM [email protected]
CVSS 4.0 HIGH 83251b91-4cc7-4094-a5c7-464a1b83ea10
CVSS 4.0 HIGH [email protected]
Solution
Enable HttpOnly and Secure flags for session cookies and enforce HTTPS.
  • Update Pinpoint to a version that addresses session management.
  • Configure web server to enforce HTTPS.
  • Ensure session cookies have HttpOnly and Secure flags set.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-57948.

URL Resource
https://github.com/pinpoint-apm/pinpoint/issues/13858
https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt
https://github.com/pinpoint-apm/pinpoint/issues/13858
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-57948 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-57948 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-57948 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-57948 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    Jul. 14, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://github.com/pinpoint-apm/pinpoint', 'vendor': 'pinpoint-apm', 'product': 'pinpoint', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '3.1.0'}], 'defaultStatus': 'unaffected'}] [{'repo': 'https://github.com/pinpoint-apm/pinpoint', 'vendor': 'pinpoint-apm', 'product': 'pinpoint', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '3.1.0'}], 'packageURL': 'pkg:github/pinpoint-apm/pinpoint', 'defaultStatus': 'unaffected'}]
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Jul. 02, 2026

    Action Type Old Value New Value
    Changed SSVC {'id': 'CVE-2026-57948', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-01T00:00:00+00:00'} {'id': 'CVE-2026-57948', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-02T03:57:12.172783Z'}
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Jul. 02, 2026

    Action Type Old Value New Value
    Changed SSVC {'id': 'CVE-2026-57948', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-30T13:58:13.068275Z'} {'id': 'CVE-2026-57948', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-01T00:00:00+00:00'}
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Jun. 30, 2026

    Action Type Old Value New Value
    Added Reference https://github.com/pinpoint-apm/pinpoint/issues/13858
    Added SSVC {'id': 'CVE-2026-57948', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-30T13:58:13.068275Z'}
  • New CVE Received by [email protected]

    Jun. 29, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://github.com/pinpoint-apm/pinpoint', 'vendor': 'pinpoint-apm', 'product': 'pinpoint', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '3.1.0'}], 'defaultStatus': 'unaffected'}]
    Added Description Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
    Added CVSS V4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CVSS V3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    Added CWE CWE-1004
    Added CWE CWE-614
    Added Reference https://github.com/pinpoint-apm/pinpoint/issues/13858
    Added Reference https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.