CVE-2026-78174 — WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and …
Published: 2026-08-27 · CVSS: 9.3 · CVSS 4.0
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7