Sensitive Cookie Without 'HttpOnly' Flag in WeGIA - #VU166192
Published: November 13, 2026
Vulnerability identifier: #VU166192
CSH Severity: High
CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1004
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to steal authentication session identifiers and potentially impersonate authenticated users.
The vulnerability exists due to omission of the HttpOnly attribute in WeGIA's PHP session cookie configuration when issuing PHPSESSID cookies. A remote attacker can leverage JavaScript execution in the application's origin, for example through cross-site scripting, to read PHPSESSID through document.cookie and potentially reuse the identifier to impersonate the associated user while the session remains valid.
Affected software
WeGIA
Remediation
Install security update from vendor's website.
WeGIA - update to 4.2.0