Bypass of Multi-Factor Authentication in ApostropheCMS

CVE-2026-32730

What is CVE-2026-32730?

A significant vulnerability in ApostropheCMS allows attackers to bypass multi-factor authentication due to an incorrect MongoDB query in the bearer token authentication middleware. This flaw permits the use of incomplete login tokens, where only the password was verified while multi-factor authentication (MFA) requirements were not enforced. As a result, attackers can gain unauthorized access to systems that employ the '@apostrophecms/login-totp' plugin or similar configurations. The issue has been addressed in version 4.28.0, highlighting the necessity for users to upgrade to ensure robust security against this vulnerability.

References