Description
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ConnectWise | PSA | All versions prior to 2026.1 | — |