Pinpoint-apm vulnerabilities
Published CVEs affecting Pinpoint-apm products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-57948
Medium · 6.8
CWE-614 Jun 29, 2026
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
CVE-2026-57947
High · 8.5
CWE-918 Jun 29, 2026
Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration
Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.