CVE-2026-103279: Ghost CMS Auth Bypass Vulnerability

CVE-2026-103279 Overview

Ghost, the open-source publishing platform, contains a session management flaw affecting versions from 3.10.0 before 6.34.0. The platform fails to fully invalidate all active sessions when a user changes their password. Attackers who previously obtained a valid session cookie can retain access to the account even after the legitimate user rotates credentials.

The weakness is tracked under CWE-613: Insufficient Session Expiration. It defeats the primary user remediation step for suspected account compromise, allowing persistent access through stolen cookies.

Critical Impact
Stolen Ghost session cookies remain valid after password resets, enabling account takeover persistence despite user remediation.

Affected Products

Ghost versions 3.10.0 through versions prior to 6.34.0
Self-hosted Ghost installations within the affected range
Ghost(Pro) deployments running vulnerable versions

Discovery Timeline

2026-10-01 - CVE-2026-103279 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103279

Vulnerability Analysis

Ghost maintains user sessions through server-side session storage keyed by browser cookies. When an authenticated user changes their password through the admin interface, the application is expected to revoke all existing session identifiers tied to that account. In affected versions, the password change workflow does not iterate over and destroy sibling sessions.

An attacker who obtains a session cookie through phishing, cross-site scripting, malware, or network interception can replay that cookie against the Ghost admin API. The replay succeeds even after the account owner changes their password in response to a suspected compromise. The attacker retains the ability to publish, modify, or exfiltrate content tied to the hijacked account until the session store entry naturally expires.

Root Cause

The root cause is incomplete session invalidation logic in the credential rotation handler. The handler updates the stored password hash but does not purge the session store of records associated with the user identifier. This matches the [CWE-613] pattern where session lifetime is decoupled from authentication state changes.

Attack Vector

Exploitation requires an attacker to possess an existing valid session cookie for a Ghost user account. The attack is network-based and requires low privileges on the attacker side but assumes prior credential or token theft. Once the cookie is held, the attacker issues authenticated HTTP requests to the Ghost admin or content API. Password rotation by the victim does not terminate the attacker's active session, so unauthorized access persists until the session TTL elapses or the server is restarted with session store flushing.

No verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-v9vj-6fq5-99xj and the VulnCheck Advisory on Ghost Bypass.

Detection Methods for CVE-2026-103279

Indicators of Compromise

Admin API requests from source IP addresses that differ from the account owner's historical login locations after a recent password change event
Session cookies that remain active across password reset events in the Ghost session store
Content publication, user creation, or integration token creation events performed by accounts outside their normal activity windows

Detection Strategies

Correlate users.password_updated events with subsequent authenticated API activity reusing pre-change session identifiers
Review Ghost reverse proxy logs for Cookie: ghost-admin-api-session values that persist across password reset timestamps
Alert on administrative actions originating from user agents or geolocations that first appeared before a password change

Monitoring Recommendations

Enable verbose authentication logging on Ghost and forward it to a centralized log platform for correlation
Track session store entry counts per user and alert when stale sessions outlive credential rotation events
Monitor outbound content changes and theme or integration modifications for unexpected authorship

How to Mitigate CVE-2026-103279

Immediate Actions Required

Upgrade Ghost to version 6.34.0 or later on all self-hosted instances
After upgrading, force a global session flush by clearing the sessions table or restarting the Node.js process with session storage reinitialized
Rotate passwords for all administrative and author accounts following the upgrade to invalidate any attacker-held cookies
Revoke and reissue any staff API keys or integration tokens that may have been exposed during the vulnerable window

Patch Information

The Ghost maintainers resolved the issue in version 6.34.0. The fix extends the password change handler to invalidate all server-side session records tied to the affected user identifier. Review the GitHub Security Advisory GHSA-v9vj-6fq5-99xj for upgrade guidance and the complete list of affected versions.

Workarounds

Manually purge the Ghost session store after any password change until the upgrade is applied
Shorten session cookie lifetimes in the Ghost configuration to reduce the attacker's post-compromise window
Restrict administrative API access to known IP ranges using a reverse proxy or web application firewall

bash

# Example: clear Ghost session store (MySQL) after a password change
mysql -u ghost_user -p ghost_db -e "DELETE FROM sessions WHERE user_id = '<USER_ID>';"

# Restart the Ghost process to drop any in-memory session caches
ghost restart