CVE-2026-57948

Name of the Vulnerable Software and Affected Versions Pinpoint versions prior to 3.1.1

Description Insecure session management occurs because the pinpointJwt session cookie lacks HttpOnly and Secure attributes. This allows the cookie to be accessed via JavaScript through document.cookie and transmitted in cleartext over HTTP. Attackers can leverage stored or reflected cross-site scripting to exfiltrate the session token or use network sniffing to intercept it, leading to session hijacking.

Recommendations Update Pinpoint to a version later than 3.1.0.