CVE-2026-113669
Received Received - Intake

Session Hijacking in ApostropheCMS via Bearer Token

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113669
EUVD
EUVD-2026-105218

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0
@apostrophecms passport-bridge < 1.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.33.0 and passport-bridge before 1.6.1 have a flaw where session migration between domains or locales uses a single-use bearer token passed in a URL. This token, stored in MongoDB cache, allows any client with the token to silently adopt the target user's full session, including authentication details, without credentials. The token is exposed in URLs, browser history, logs, and Referer headers, making it easy to intercept.

Detection Guidance

Check for unusual session tokens in URLs, browser history, server logs, or Referer headers. Inspect MongoDB cache for single-use tokens passed as query parameters during cross-domain or cross-locale session migrations.

Impact Analysis

An attacker who intercepts a valid, unused token URL can redeem it to gain the victim's session cookie and privileges. This allows unauthorized access to restricted content, user accounts, or sensitive data. The single-use nature reduces risk but does not prevent exposure if the token is captured before use.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or later and @apostrophecms/passport-bridge to 1.6.1 or later. Ensure tokens are delivered via short-lived HttpOnly signed SameSite cookies instead of URL parameters. Bind token consumption to specific host pairs and set brief expiration times.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart