GHSA-GMJ8-HVJ3-49MW Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Impact Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins write the session cookie without a SameSite attribute, regardless of...

CVE-2026-126067

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067 Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067

The Action Pack framework is vulnerable to Cross-Site Request Forgery (CSRF) because session stores other than ActionDispatch::Session::CookieStore (such as CacheStore, MemCacheStore, and certain third-party stores) do not include a SameSite attribute on session cookies. This occurs because only ...

FreeBSD : p5-Dancer -- possible to abuse session cookie values (968d1e74-1740-11e5-a643-40a8f0757fb4)

Russell Jenkins reports : It was possible to abuse session cookie values so that file-based session stores such as Dancer::Session::YAML or Dancer2::Session::YAML would attempt to read/write from any file on the filesystem with the same extension the file-based store uses, such as '.yml' for the...