| Package | Affected versions | Patched versions |
|---|---|---|
| professional service automation | < 2026.1 | 2026.1 |
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free