EUVD-2026-40165
GHSA-f4g5-7fg3-8rw6
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but exploitation is gated on a secondary XSS or cleartext-sniffing condition (AC:H) and an interacting authenticated victim (UI:R); stolen JWT yields session takeover (C:H/I:H, A:N).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
AnalysisAI
Session hijacking in Pinpoint (open-source APM) through version 3.1.0 stems from the pinpointJwt session cookie being issued without the HttpOnly and Secure flags, letting client-side JavaScript read it via document.cookie and allowing it to traverse cleartext HTTP. An attacker who can land a stored or reflected XSS payload, or who can sniff network traffic, can steal the JWT session token and impersonate the victim. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; the CVSS 4.0 base score is 7.6.
Technical ContextAI
Pinpoint is a distributed-tracing Application Performance Management (APM) platform (pinpoint-apm/pinpoint) whose web UI authenticates users with a JWT carried in a cookie named pinpointJwt. The flaw is classed as CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute), with the related absence of HttpOnly compounding it: HttpOnly normally blocks document.cookie access from JavaScript, and Secure normally restricts the cookie to TLS. With both omitted, any script execution context (XSS) can read the token, and any plaintext HTTP request leaks it on the wire. Because the token is a bearer JWT, possession alone is sufficient to assume the session - no password or second factor is re-validated.
RemediationAI
No vendor-released patch version is identified at time of analysis; the only references are an upstream GitHub issue (https://github.com/pinpoint-apm/pinpoint/issues/13858) and the VulnCheck advisory (https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt), so monitor those for a tagged release and upgrade once available. As immediate compensating controls, set the HttpOnly and Secure attributes on the pinpointJwt cookie at a reverse proxy or load balancer (for example, Nginx 'proxy_cookie_flags pinpointJwt httponly secure;' or an equivalent response-header rewrite), which neutralizes both JavaScript theft and cleartext leakage but may break any legitimate client-side script that reads the cookie. Enforce HTTPS-only access and HSTS so the cookie can never be transmitted over HTTP, and restrict the Pinpoint web UI to trusted internal networks or behind a VPN to remove untrusted network-sniffing positions; the trade-off is reduced accessibility for remote operators. Reducing the JWT session lifetime limits the window of a stolen token at the cost of more frequent re-authentication.
Vendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today