medium6.5
CVE-2026-0696
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute.
Impact
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Connectwise | Professional Service Automation | before 2026.1 |