Go to packages list

apostrophecms-passport-bridge

Ecosystem: npm

Downloads: 1.26 K

Vulnerabilities from the last (months)

0CriticalAffects 0 versions
0HighAffects 0 versions
0MediumAffects 0 versions
1ModerateAffects 1 version
0LowAffects 0 versions

Severity distribution (all time)

1vulnerability

Critical0 (0.0%)
High0 (0.0%)
Medium0 (0.0%)
Moderate1 (100.0%)
Low0 (0.0%)

Monthly breakdown

Oct 20261 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0

Vulnerabilities (1)

Known vulnerabilities affecting apostrophecms-passport-bridge, based on data from OSV.

Filter by severitySort by

Vulnerabilities affecting apostrophecms-passport-bridge
ID	Severity	Summary	Affected versions	Published	Source
GHSA-hhvr-8m24-qqr3	Moderate	ApostropheCMS: Cross-domain session token in URL confers session takeoverSummary Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials. Details `packages/apostrophe/modules/@apostrophecms/i18n/index.js`: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL. - `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`,	`< 1.6.1`	2026-10-20	GitHub (opens in a new tab)

GHSA-hhvr-8m24-qqr3Moderate
ApostropheCMS: Cross-domain session token in URL confers session takeover
- < 1.6.1
2026-10-20GitHub (opens in a new tab)
**Summary** Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials. **Details** `packages/apostrophe/modules/@apostrophecms/i18n/index.js`: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL. - `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`,
CVE: CVE-2026-113669