WebDyne versions from 2.014 up to but not including 3.022 for Perl set session cookies without the Secure, HttpOnly, and SameSite attributes. This omission allows browsers to send session IDs over unencrypted HTTP connections and include them in cross-site requests, exposing the session to theft by network attackers or malicious scripts.