Description (CNA)
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ConnectWise / PSA | affected All versions prior to 2026.1 |
CWE
CWE-1004
References
- https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix
- https://www.themissinglink.com.au/security-advisories/cve-2026-0696
ADP enrichment
No English description supplied.
No references supplied.