CVE-2026-113669 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS is an open-source content management system built on Node.js that facilitates web application development through a modular architecture. A significant security vulnerability was identified within the session handling mechanisms of ApostropheCMS versions prior to 4.33.0 and its associated passport-bridge module prior to version 1.6.1. This flaw specifically impacts cross-host or cross-locale session migration flows, where the system attempts to transfer user authentication state between different domains or language locales. The core technical issue lies in how single-use bearer session tokens are generated and transmitted during this migration process. Instead of utilizing a secure channel such as POST data or HTTP-only cookies with strict SameSite attributes, the vulnerable implementation places these sensitive tokens directly within redirect URLs using GET parameters.
The presence of the token in the URL creates multiple vectors for unauthorized access due to standard web browser behaviors and logging mechanisms. When a bearer session token is included in a URI, it becomes susceptible to leakage through several common channels. First, the full URL containing the token may be logged by intermediate proxies, load balancers, or web server logs that record request history. Second, browsers often transmit referrer information when users navigate away from the page where the redirect occurred; if this happens before the token is consumed, the destination site receives a copy of the session identifier in its HTTP Referer header. Third, such URLs are frequently stored in browser history and may be visible to other applications or scripts with access to browsing data on the client machine. This design fundamentally violates the principle that authentication credentials should never appear in URL parameters due to their inherent exposure risk.
The operational impact of this vulnerability is severe because it enables session hijacking through cross-host or cross-locale attacks. An attacker who can intercept, observe, or predict the redirect URL containing the single-use token can redeem it before the legitimate user does. Since the token is designed for one-time use but remains valid until consumed, a race condition allows an adversary to adopt the associated session state. This effectively grants the attacker full control over the victim's authenticated session, including access privileges defined by that session. In the context of passport-bridge cross-locale flows, this means an attacker could potentially escalate their privileges or impersonate users across different localized versions of the application if they can manipulate the redirect flow to capture the token. This undermines the integrity and confidentiality guarantees provided by the authentication system.
This vulnerability aligns with CWE-598 Improper Use of URL in Security Context, as it involves the inappropriate inclusion of sensitive data within a URI that is exposed outside the secure communication channel. Furthermore, from an adversary perspective, this flaw facilitates ATT&CK technique T1078 Valid Accounts, specifically through session hijacking or credential theft via intercepting authentication flows. The lack of proper token binding and exposure in client-side storage mechanisms allows for unauthorized access without requiring password cracking or complex exploitation chains beyond simple network sniffing or referrer leakage.
To mitigate this vulnerability, organizations must upgrade to ApostropheCMS version 4.33.0 and passport-bridge version 1.6.1 or later, where the session migration logic has been corrected to avoid exposing tokens in URLs. For systems that cannot immediately patch due to dependency constraints, temporary mitigations include implementing strict Content Security Policy headers to restrict referrer information leakage via Referrer-Policy directives set to no-referrer or same-origin. Additionally, ensuring that all authentication endpoints use POST requests for token exchange rather than GET redirects can prevent URL-based exposure. Monitoring server logs and proxy records for unusual patterns of session token usage may also help detect potential exploitation attempts in real-time until the software is updated.