Unrated severityNVD Advisory· Published Jan 16, 2026· Updated Jan 27, 2026

Session Cookies Missing HttpOnly Attribute

CVE-2026-0696

Description

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

Affected products

Connectwise/PSAllm-create
Range: < 2026.1
ConnectWise/PSAv5
Range: All versions prior to 2026.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fixmitre
www.themissinglink.com.au/security-advisories/cve-2026-0696mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000