{"id":"CVE-2026-22644","aliases":["EUVD-2026-2798","GHSA-x9mj-9378-r98g"],"status":"published","title":"Certain requests pass the authentication token in the URL as string query parameter, making it...","description":"Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0053,"percentile":0.45091,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-598"],"published":"2026-01-15T13:14:13Z","modified":"2026-06-17T10:20:11Z","products":[{"vendor":"sick","product":"incoming_goods_suite"},{"vendor":"sick ag","product":"incoming goods suite"}],"references":[{"url":"https://sick.com/psirt","tags":["x_SICK PSIRT Security Advisories","Vendor Advisory"]},{"url":"https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf","tags":["x_SICK Operating Guidelines","Product"]},{"url":"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices","tags":["x_ICS-CERT recommended practices on Industrial Security","US Government Resource"]},{"url":"https://www.first.org/cvss/calculator/3.1","tags":["x_CVSS v3.1 Calculator","Not Applicable"]},{"url":"https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.json","tags":["x_The canonical URL.","Vendor Advisory"]},{"url":"https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22644"},{"url":"https://github.com/advisories/GHSA-x9mj-9378-r98g"}],"sources":{"cve":[{"id":"CVE-2026-22644","description":"Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.","status":"published","published":"2026-01-15T13:14:13.694Z","modified":"2026-01-15T14:52:44.218Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-2798","description":"Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.","status":"published","published":"2026-01-15T13:14:13Z","modified":"2026-01-15T14:52:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:51.36047Z"}],"ghsa":[{"id":"GHSA-x9mj-9378-r98g","title":"Certain requests pass the authentication token in the URL as string query parameter, making it...","description":"Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.","status":"published","published":"2026-01-15T15:31:20Z","modified":"2026-01-15T15:31:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T15:05:37.551338Z"}],"nvd":[{"id":"CVE-2026-22644","description":"Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.","status":"published","published":"2026-01-15T14:16:28.163Z","modified":"2026-06-17T10:20:11.74Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T14:12:04.066712Z"}]}}