Description

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

Related CPE's

a

connectwise

professional_service_automation

Vulnerable

References

https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix

Vendor Advisory

Weaknesses

7d616e1a-3288-43b1-a0dd-0a65d3e70a49

Secondary
CWE-1004

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.5 · Medium

Information

Source identifier

7d616e1a-3288-43b1-a0dd-0a65d3e70a49

Vulnerability status

Analyzed

Published

2026-01-16T14:15:54.940Z

1 month ago

Last modified

2026-01-23T16:45:35.553Z

3 weeks ago