ApostropheCMS CVE-2026-113669

Exploitation requires the ApostropheCMS cross-host or cross-locale session migration feature to be in active use (including the passport-bridge cross-locale authentication flow), as this is what places the single-use bearer session token into a redirect URL. The attacker must (1) obtain that token from the URL - e.g. via Referer-header leakage to another host, proxy/server logs, browser history, or an intercepted/shared link - and (2) redeem it while it is still valid and not yet consumed by the legitimate client. Limiting factors: the token is single-use and time-bounded, forcing the attacker to win a race against the victim's first use; environments not using cross-host or cross-locale migration are not exposed. Affects ApostropheCMS before 4.33.0 and passport-bridge before 1.6.1.

This is a genuine but moderate-severity session-handling flaw (CWE-598: sensitive information in a GET/redirect URL), not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields 5.3 (Medium), reflecting limited low-confidentiality/integrity/availability impact rather than full compromise. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit was supplied - so exploitation status is 'no public exploit identified at time of analysis.' The realistic barrier is a race condition: the attacker must obtain the single-use bearer token from the redirect URL AND redeem it while still unconsumed, before the legitimate client's first use. This timing/interception requirement meaningfully lowers practical risk below what the 'AC:L/AT:N' metrics imply - I would argue an attack requirement (4.0 AT:P / 3.1 AC:H) is more honest. Combined with the product's small deployment footprint, this is a real issue to patch but unlikely to see widespread opportunistic exploitation. The input CVSS uses PR:L; the attacker does not necessarily hold privileges themselves but rides an authenticated migration flow, so PR:L is defensible.

During ApostropheCMS cross-host or cross-locale session migration (including the passport-bridge cross-locale flow), a valid single-use bearer session token is embedded in a redirect URL. An attacker who can observe that URL - via Referer header leakage to a third-party host, proxy/server access logs, browser history, or a shared link - redeems the still-unconsumed token first and adopts the victim's session. No public proof-of-concept was provided; success depends on winning the race before the legitimate client consumes the token.