{"id":"EUVD-2026-105218","enisaUuid":"d1b45290-2cd6-32ae-b528-0c5f0cc2e604","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.","datePublished":"Oct 20, 2026, 5:35:40 PM","dateUpdated":"Oct 23, 2026, 1:58:19 AM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhvr-8m24-qqr3\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","aliases":"CVE-2026-113669\nGHSA-hhvr-8m24-qqr3\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"b12489bb-1302-3b49-930b-254cb5d48785","product":{"name":"passport-bridge","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.6.1"},{"id":"c59e2dbf-c7d1-3519-9728-1521ed540ba6","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"enisaIdVendor":[{"id":"46a43c4c-d29d-329b-828a-9057b76af38f","vendor":{"name":"@apostrophecms"}},{"id":"f44346e7-f4c0-3e9d-83c2-b1053ab277e2","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"0ef48b2c-f60e-3500-8dc2-29f6409a6300","vulnerability":{"id":"GHSA-hhvr-8m24-qqr3","description":"ApostropheCMS: Cross-domain session token in URL confers session takeover","datePublished":"Oct 20, 2026, 6:09:01 PM","dateUpdated":"Oct 20, 2026, 6:09:01 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhvr-8m24-qqr3\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-105218\n","aliases":"CVE-2026-113669\nGHSA-hhvr-8m24-qqr3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"87a1a159-d3d0-380a-9d51-63d361949a09","vulnerability":{"id":"CVE-2026-113669","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.","datePublished":"Oct 20, 2026, 5:35:40 PM","dateUpdated":"Oct 23, 2026, 1:58:19 AM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhvr-8m24-qqr3\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","enisa_id":"EUVD-2026-105218\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 6, 2026, 7:15:43 AM","vulnerabilityProduct":[{"id":"2110fcac-dbd9-3516-874e-a7b6b61de763","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"},{"id":"b377e049-357e-35c6-a6c4-4e9862778bc4","product":{"name":"passport-bridge","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.6.1"}],"vulnerabilityVendor":[{"id":"6fbd0676-e619-37e6-9041-4569c794461b","vendor":{"name":"apostrophecms"}},{"id":"72c0b2b8-b823-34bb-93ba-846b95c613c2","vendor":{"name":"@apostrophecms"}}]}}],"enisaIdAdvisory":[]}