CVE-2026-113669

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 passport-bridge versions prior to 1.6.1

Description Cross-host or cross-locale session migration emits a single-use bearer session token as a URL query parameter. A client that obtains this token before its first use can adopt the associated session, including the passport.user object, without providing credentials. This allows for session hijacking and account takeover, granting the attacker the full privileges of the migrated user. The risk is increased because tokens in URLs can be exposed through server logs, proxy logs, browser history, and the Referer header. The issue occurs within the acceptCrossDomainSessionToken function, which reads the aposCrossDomainSessionToken parameter and assigns the stored session to req.session.

Recommendations Update ApostropheCMS to version 4.33.0 or later. Update passport-bridge to version 1.6.1 or later.