CVE-2026-78174 — WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs

CVE-2026-78174

WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs PUBLISHED

Description (CNA)

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.

Affected (CNA)

Vendor / product	Versions
WatchGuard / Dimension	affected 2.0 before 2.3.1

CWE

CWE-200, CWE-269, CWE-532

References

https://psirt.watchguard.com/CVE-2026-78174

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.