Security fix · CVE-2026-113669
ApostropheCMS is an open-source Node.js content management system.
Published Oct 20, 2026 · catalog updated Oct 23, 2026 · ApostropheCMS is an open-source
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-113669. EPSS is 0.42%. Act only if a listed version of ApostropheCMS is an open-source is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (ApostropheCMS is an open-source).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.42%
- Remediation
- Advisory link
- Affected products
- npm @apostrophecms/passport-bridge · npm apostrophe · package npm
**Summary** Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including ) with no credentials. **Details** : - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect ( L557–593) places the token in the URL. - (L258–298) reads , s the stored session (cookie + ) onto , then nulls the cache entry under namespace . - Middleware without is registered for every URL (express L820–879); verified with . **PoC** **Impact** Session hijack / account takeover of the migrated user for anyone who obtains the token, inheriting all the account's privileges. Exposure is realistic precisely because the token is in URLs: server/proxy/browser-access logs, browser history, and the Referer header when the destination host differs from the source (the intended use case). Single-use limits but does not remove the window. **Remediation** — Deliver the token via a short-lived HttpOnly signed SameSite cookie rather than a query parameter; bind consumption to the exact source/destination host pair, expire in seconds, and never log it.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm @apostrophecms/passport-bridge0 → 1.6.1
- npm apostrophe0 → 4.33.0
- package npmversion unspecified
How to fix CVE-2026-113669
Upgrade
CVE-2026-113669 lists a fix boundary at 1.6.1. Compare the installed build with that boundary before you change production.
Version check
Fixed in 1.6.1 · 1 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-113669. EPSS is 0.42%. Act only if a listed version of ApostropheCMS is an open-source is installed.
Which versions are affected?
Compare what you have installed with 0 → 1.6.1, 0 → 4.33.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-598. EPSS 0.42%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 20, 2026 · GitHub Advisory Database
Fix available
apostrophe fixed in 4.33.0; @apostrophecms/passport-bridge fixed in 1.6.1
Oct 20, 2026 · NIST NVD
Detected
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-
Oct 20, 2026 · GitHub Advisory Database
Fix available
apostrophe fixed in 4.33.0
Oct 20, 2026 · GitHub Advisory Database
Fix available
@apostrophecms/passport-bridge fixed in 1.6.1
Oct 23, 2026 · NIST NVD
Updated
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-
Sources
- CVE.orgVulnerability recordCVE-2026-113669
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-113669
30-day exploitation probability 0.42%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-hhvr-8m24-qqr3
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDVulnerability recordCVE-2026-113669
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-val
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-hhvr-8m24-qqr3
ApostropheCMS: Cross-domain session token in URL confers session takeover
osv.dev - Snyk Vulnerability DatabasePackage advisorySNYK-JS-APOSTROPHE-21431306
Use of GET Request Method With Sensitive Query Strings
security.snyk.io - Snyk Vulnerability DatabasePackage advisorySNYK-JS-APOSTROPHECMSPASSPORTBRIDGE-21431305
Use of GET Request Method With Sensitive Query Strings
security.snyk.io
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 6, 2026
- Snyk Vulnerability DatabaseOct 24, 2026
- Snyk Vulnerability DatabaseOct 24, 2026
- NIST NVDOct 23, 2026
- CVE.orgOct 21, 2026
- GitHub Advisory DatabaseOct 20, 2026
- OpenSSF OSV / OSV ScannerOct 20, 2026