CVE-2026-113669: ApostropheCMS Cross-domain Session Token Vulnerability Leading to Session Takeover
Summary
CVE-2026-113669: ApostropheCMS: Cross-domain session token in URL confers session takeover. Affects apostrophe versions < 4.33.0. Fixed in 4.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It allows users to create and manage content seamlessly while providing features like localization, user authentication, and a rich editing experience. However, a vulnerability has been identified in its session management mechanism, specifically in how it handles cross-domain session migration, which can lead to unauthorized access to user sessions.
Vulnerability Detail
The vulnerability arises from ApostropheCMS's method of emitting a single-use session token as a URL query parameter during cross-domain session migration. This token, when intercepted by an attacker, allows them to adopt the target user's session without needing any credentials. The token is stored in the Mongo cache and is accessible through the URL, making it susceptible to exposure in server logs, browser history, and the Referer header. This could lead to session hijacking and account takeover, granting the attacker full access to the user's privileges.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.33.0
This is the first release that contains the fix.
npm install apostrophe@4.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider delivering the session token via a short-lived HttpOnly signed SameSite cookie instead of a URL query parameter. This approach binds the token consumption to the exact source and destination host pair, expiring it within seconds to minimize exposure.
Conclusion
The CVE-2026-113669 vulnerability in ApostropheCMS poses a significant risk due to its potential for session hijacking and account takeover. It is crucial for users to update to the patched versions of the affected packages and consider implementing additional security measures to protect user sessions.
See every vulnerability recorded for apostrophe →
FAQ
The vulnerability involves a cross-domain session token being exposed as a URL query parameter, allowing unauthorized users to hijack sessions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If exploited, the vulnerability can lead to session hijacking and account takeover, allowing attackers to access sensitive user data and perform actions on behalf of the user.
Yes, the vulnerability has been patched in ApostropheCMS version 4.33.0 and @apostrophecms/passport-bridge version 1.6.1.
If immediate updates are not possible, implement the suggested workaround of using HttpOnly signed SameSite cookies to deliver session tokens securely.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
