ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

Affected: npm: apostrophe, npm: @apostrophecms/passport-bridge

**Summary** Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials.

**Details** `packages/apostrophe/modules/@apostrophecms/i18n/index.js`: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL. - `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`. - Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.

**PoC** ``` # 0) Anonymous baseline: admin-only draft → 403 # 1) Admin logs in legitimately (token minted into redirect URL): curl -c admin.cookies -X POST -H "Content-Type: application/json" \ --data '{"username":"admin","password":"adminpassword","session":true}' \ http://localhost:3100/api/v1/@apostrophecms/login/login # 2) Attacker with NO credentials visits the leaked token URL: curl -c atk.cookies "http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN" # → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie # 3) Attacker reads adm…