ConnectWise PSA Sensitive Cookie Without 'HttpOnly' Flag Vulnerability

A vulnerability exists in ConnectWise PSA versions prior to 2026.1, where certain session cookies were not configured with the 'HttpOnly' attribute. This oversight could potentially allow client-side scripts to access session cookie values, posing a risk of cookie theft or session hijacking.

Impact

Exploitation of this vulnerability could lead to unauthorized access to session cookies, allowing for potential session hijacking.

Remediation

Users can upgrade to the ConnectWise PSA 2026.1 release. For on-premise installations, apply the 2026.1 release patches and ensure all desktop clients are up to date.