{"id":"CVE-2026-113669","title":"ApostropheCMS: Cross-domain session token in URL confers session takeover","summary":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-598"],"vendor":"apostrophecms","product":"apostrophe","affected":["apostrophe < 4.33.0","passport-bridge < 1.6.1"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T01:57:52.354848Z"},"exploitAvailable":true,"published":"2026-10-20","updated":"2026-10-23","sourceUpdated":"2026-10-23T01:58:19.763Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113669","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhvr-8m24-qqr3","label":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhvr-8m24-qqr3"},{"url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","label":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","label":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0","label":"https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"},{"url":"https://github.com/advisories/GHSA-hhvr-8m24-qqr3"}],"tags":["cve.org","exploit-available","ghsa","npm"],"epss":0.00416,"epssPercentile":0.35749,"aliases":["GHSA-hhvr-8m24-qqr3"],"ecosystem":"npm","patched":["apostrophe 4.33.0","@apostrophecms/passport-bridge 1.6.1"],"ingestedAt":"2026-10-20T18:14:37.212Z","slug":"CVE-2026-113669","body":"## Overview\n\nApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.\n\n## Affected\n\n- `apostrophe < 4.33.0`\n- `passport-bridge < 1.6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-113669)\n\nAffected packages:\n\n- `apostrophe < 4.33.0`\n- `@apostrophecms/passport-bridge < 1.6.1`\n\nPatched in:\n\n- `apostrophe 4.33.0`\n- `@apostrophecms/passport-bridge 1.6.1`\n\nSource: https://github.com/advisories/GHSA-hhvr-8m24-qqr3","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":227914,"id":"CVE-2026-113669","ts":1792721607070,"field":"exploit_available","old":"false","new":"true"}]}