https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 22:32:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113669 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113669 https://db.gcve.eu/vuln/ghsa-hhvr-8m24-qqr3 <p><strong>Affected:</strong> npm: apostrophe, npm: @apostrophecms/passport-bridge</p> <p>**Summary** Apostrophe&#39;s cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user&#39;s full session (including `passport.user`) with no credentials.</p> <p>**Details** `packages/apostrophe/modules/@apostrophecms/i18n/index.js`: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL. - `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`. - Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.</p> <p>**PoC** ``` # 0) Anonymous baseline: admin-only draft → 403 # 1) Admin logs in legitimately (token minted into redirect URL): curl -c admin.cookies -X POST -H &#34;Content-Type: application/json&#34; \ --data &#39;{&#34;username&#34;:&#34;admin&#34;,&#34;password&#34;:&#34;adminpassword&#34;,&#34;session&#34;:true}&#39; \ http://localhost:3100/api/v1/@apostrophecms/login/login # 2) Attacker with NO credentials visits the leaked token URL: curl -c atk.cookies &#34;http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN&#34; # → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie # 3) Attacker reads adm…</p> <p><strong>Affected:</strong> npm: apostrophe, npm: @apostrophecms/passport-bridge</p> <p>**Summary** Apostrophe&#39;s cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user&#39;s full session (including `passport.user`) with no credentials.</p> <p>**Details** `packages/apostrophe/modules/@apostrophecms/i18n/index.js`: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL. - `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`. - Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.</p> <p>**PoC** ``` # 0) Anonymous baseline: admin-only draft → 403 # 1) Admin logs in legitimately (token minted into redirect URL): curl -c admin.cookies -X POST -H &#34;Content-Type: application/json&#34; \ --data &#39;{&#34;username&#34;:&#34;admin&#34;,&#34;password&#34;:&#34;adminpassword&#34;,&#34;session&#34;:true}&#39; \ http://localhost:3100/api/v1/@apostrophecms/login/login # 2) Attacker with NO credentials visits the leaked token URL: curl -c atk.cookies &#34;http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN&#34; # → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie # 3) Attacker reads adm…</p> https://db.gcve.eu/vuln/ghsa-hhvr-8m24-qqr3