CVE-2026-70594

Name of the Vulnerable Software and Affected Versions Ghost versions 2.2.0 through 6.54.0

Description Ghost Admin fails to invalidate existing sessions during the login process, which could enable session fixation attacks. Session fixation is a method where an attacker provides a valid session identifier to a user and then waits for the user to authenticate, allowing the attacker to hijack the authenticated session. Successful exploitation of this issue requires the presence of another vulnerability on the same domain where Ghost Admin is hosted.

Recommendations Update Ghost to version 6.54.1.