CVE-2026-53497

Received Received - Intake

CrossWatch Session Metadata Exposure via Unauthenticated API

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53497

Affected Vendors & Products

Vendor	Product	Version / Range
crosswatch	crosswatch	to 0.9.21 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-359	The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CrossWatch (CW) is a synchronization engine. A vulnerability exists in versions prior to 0.9.21 where the endpoint GET /api/app-auth/status is accessible without authentication. This endpoint returns an array called other_sessions that contains sensitive metadata about all active sessions, including IP addresses, User-Agent strings, session IDs, and timestamps.

Detection Guidance

To detect this vulnerability, check if the endpoint /api/app-auth/status is accessible without authentication. Use curl to send a GET request to the endpoint and verify if it returns session metadata. Example command: curl -v http://<target-ip>/api/app-auth/status. If the response includes session details without requiring credentials, the system is vulnerable.

Impact Analysis

An unauthenticated attacker can access this endpoint and enumerate session data. This could allow them to gather information about active users, their locations, and session details. While the vulnerability does not directly allow data modification or access, it exposes sensitive operational information that could be used for further attacks.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR and HIPAA by exposing personally identifiable information (PII) and session metadata without proper access controls. GDPR requires protection of personal data, and HIPAA mandates safeguards for sensitive health information. Unauthorized exposure of such data could lead to regulatory penalties.

Mitigation Strategies

Upgrade CrossWatch to version 0.9.21 or later, which fixes the authentication bypass issue. If an upgrade is not immediately possible, restrict access to the /api/app-auth/status endpoint by implementing proper authentication or network-level controls to block unauthenticated requests.

Hi! I’m here to help you understand CVE-2026-53497. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70