# CVE-2026-113669: ApostropheCMS cross-domain session token in URL confers session takeover

Source: https://junglewise.ai/threats/cve-2026-113669-apostrophecms-cross-domain-session-token-in-url-confers-session  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113669 · Severity: medium · CVSS 4 · Published 2026-10-20

ApostropheCMS is a headless content management system that allows users to manage and publish web content. When administrators authenticate and switch between locales or domains, a session token is generated and exposed in the URL as a query parameter. An attacker who obtains this token URL—through server logs, browser history, or the Referer header—can silently adopt the administrator's full session without any credentials, gaining complete access to their account and all protected content.

Technologies: [ApostropheCMS](https://junglewise.ai/threats/technologies/apostrophecms), [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe). Vendors: [ApostropheCMS](https://junglewise.ai/threats/vendors/apostrophecms), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-113669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113669 being exploited in the wild.

**How severe is CVE-2026-113669?** Medium severity, with a CVSS score of 4, published 20 October 2026.

**Which products and versions are affected?** @apostrophecms/passport-bridge (npm) < 1.6.1, SEMVER:introduced=0,fixed=1.6.1; apostrophe (npm) < 4.33.0, SEMVER:introduced=0,fixed=4.33.0.

**Is there a fix for CVE-2026-113669?** Yes. @apostrophecms/passport-bridge (npm): upgrade to 1.6.1 or later; apostrophe (npm): upgrade to 4.33.0 or later. Until then: Restrict access to cross-domain session token generation flows and disable automatic locale/domain switching until a patch is applied. Review server logs, proxy logs, and browser history for leaked tokens (URLs containing `aposCrossDomainSessionToken` parameter) and invalidate any sessions established via those tokens. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113669 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-113669?** Check whether you run ApostropheCMS, @apostrophecms/passport-bridge (npm) or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @apostrophecms/passport-bridge (npm): upgrade to 1.6.1 or later

  ```sh
  npm install @apostrophecms/passport-bridge@1.6.1
  ```

- apostrophe (npm): upgrade to 4.33.0 or later

  ```sh
  npm install apostrophe@4.33.0
  ```


Restrict access to cross-domain session token generation flows and disable automatic locale/domain switching until a patch is applied. Review server logs, proxy logs, and browser history for leaked tokens (URLs containing `aposCrossDomainSessionToken` parameter) and invalidate any sessions established via those tokens.

## Technical details

The vulnerability exists in the cross-domain session migration flow, where a single-use session token is generated in `@apostrophecms/i18n/index.js` and passed as a URL query parameter `?aposCrossDomainSessionToken` instead of a secure, HttpOnly cookie. The `acceptCrossDomainSessionToken` middleware reads this parameter and directly assigns the cached session object (including the `passport.user` object) to the current request session without authentication, allowing unauthenticated clients to adopt the target user's identity. The token is stored in the Mongo cache with no binding to source/destination hosts or short expiration, and the middleware is registered globally for all URLs without authentication checks.

## Affected products

- ApostropheCMS ApostropheCMS

## Identifiers

- CVE-2026-113669
- GHSA-hhvr-8m24-qqr3

## Timeline

- 2026-10-20: disclosed

## Related threats

- [ApostropheCMS unauthenticated file upload in import routes](https://junglewise.ai/threats/cve-2026-113711-apostrophecms-is-an-open-source-node-js-content-management)
- [ApostropheCMS password-change endpoint lacks attempt throttling](https://junglewise.ai/threats/cve-2026-113710-apostrophecms-no-attempt-throttling-on-authenticated-password)
- [ApostropheCMS page REST API authorization bypass](https://junglewise.ai/threats/cve-2026-113670-apostrophecms-page-rest-api-authorization-bypass)
- [ApostropheCMS REST route authorization bypass in locales endpoint](https://junglewise.ai/threats/cve-2026-113668-apostrophecms-id-locales-rest-route-omits-the-public-api)
- [ApostropheCMS db-connect prototype pollution denial of service](https://junglewise.ai/threats/cve-2026-113666-apostrophecms-authenticated-projection-exclusion-prototype)