Cross-host Session Migration Vulnerability in ApostropheCMS by Apostrophe
CVE-2026-113669

5.3MEDIUM

Key Information:

Vendor

Apostrophecms

Status
Apostrophe
Passport-bridge
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113669?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability that allows cross-host or cross-locale session migration. This flaw involves the placement of a single-use bearer session token in a redirect URL prior to the release of version 4.33.0. If a client acquires and utilizes a valid, unconsumed token before its initial usage, they could hijack the associated session—potentially through the passport-bridge cross-locale flow. This issue has been addressed in ApostropheCMS version 4.33.0 and passport-bridge version 1.6.1.

Affected Version(s)

apostrophe < 4.33.0

passport-bridge < 1.6.1

References

https://github.com/apostrophecms/apostrophe/security/advi...
x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commit/9500b8...
x_refsource_MISC
https://github.com/apostrophecms/apostrophe/commit/f84fd4...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.