CVE-2026-22594: Ghost CMS 2FA Auth Bypass Vulnerability

CVE-2026-22594 Overview

CVE-2026-22594 is an authentication bypass vulnerability affecting Ghost, the popular Node.js content management system. The vulnerability exists in Ghost's two-factor authentication (2FA) mechanism, allowing staff users to completely skip the email-based 2FA verification process. This flaw undermines a critical security control designed to protect administrative access to Ghost installations.

Critical Impact

Authenticated staff users can bypass 2FA protections, potentially enabling account takeover and unauthorized administrative access to Ghost CMS installations.

Affected Products

• Ghost versions 5.105.0 through 5.130.5
• Ghost versions 6.0.0 through 6.10.3

Discovery Timeline

• 2026-01-10 - CVE-2026-22594 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22594

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication) and allows authenticated staff users to circumvent the email-based two-factor authentication flow in Ghost CMS. The flaw resides in the authentication logic within the ghost/admin/app/authenticators/cookie.js file, where the authenticate function improperly handled authentication requests containing a skipEmailVerification parameter.

The vulnerable code path allowed authentication requests to bypass the 2FA verification step when a token was present, regardless of whether the user had completed the required email verification process. This means an attacker with valid staff credentials could authenticate without completing the mandatory second authentication factor.

Root Cause

The root cause stems from insufficient validation in the authentication flow. The original implementation accepted a skipEmailVerification parameter that could be exploited to bypass the 2FA requirement. Additionally, the conditional logic for token-based authentication (if (token)) was too permissive, allowing tokens to be used in conjunction with credentials to skip verification steps.

Attack Vector

The attack is network-accessible and requires low-privilege authentication (staff user credentials). An attacker who has obtained or compromised staff user credentials can exploit this vulnerability to bypass 2FA protections during the password reset flow. The attack does not require user interaction and can result in complete compromise of the staff account without triggering the expected 2FA challenge.

The vulnerable password reset controller in ghost/admin/app/controllers/reset.js would authenticate users with a skipEmailVerification: true flag, allowing the 2FA step to be bypassed entirely:

// Vulnerable code in ghost/admin/app/authenticators/cookie.js
// Source: https://github.com/TryGhost/Ghost/commit/b59f707f670e6f175b669977724ccf16c718430b

// BEFORE (Vulnerable):
authenticate({identification, password, token, skipEmailVerification}) {
    if (token) {
        const data = {token};
        const options = {
            data,

// AFTER (Fixed):
authenticate({identification, password, token}) {
    if (token && !identification && !password) {
        const data = {token};
        const options = {
            data,

The fix removes the skipEmailVerification parameter and adds stricter conditional checks to ensure token-only authentication cannot be combined with credentials to bypass verification.

Detection Methods for CVE-2026-22594

Indicators of Compromise

• Unusual authentication patterns where staff users authenticate without completing 2FA challenges
• Authentication logs showing successful logins immediately following password reset requests without corresponding 2FA verification entries
• Anomalous session creation events for staff accounts that bypass expected authentication flows

Detection Strategies

• Monitor Ghost authentication logs for staff user logins that lack corresponding 2FA verification events
• Implement alerting on password reset events immediately followed by successful authentication without 2FA completion
• Review authentication audit logs for patterns indicating authentication flow manipulation
• Deploy application-layer monitoring to detect authentication requests with unexpected parameters

Monitoring Recommendations

• Enable comprehensive logging for all authentication events in Ghost CMS
• Implement real-time alerting for staff account authentication anomalies
• Monitor for rapid succession of password reset and login events from the same user or IP address
• Review and audit staff user session creation events regularly

How to Mitigate CVE-2026-22594

Immediate Actions Required

• Upgrade Ghost CMS to version 5.130.6 or 6.11.0 immediately
• Audit all staff user accounts for unauthorized access or suspicious activity
• Review authentication logs for evidence of exploitation prior to patching
• Consider forcing password resets for all staff users after applying the patch

Patch Information

Ghost has released patched versions that address this vulnerability. The fixes are available in versions 5.130.6 (for the 5.x branch) and 6.11.0 (for the 6.x branch). The patches modify the authentication logic in ghost/admin/app/authenticators/cookie.js and ghost/admin/app/controllers/reset.js to properly enforce 2FA requirements.

For detailed patch information, refer to the GitHub Security Advisory GHSA-5fp7-g646-ccf4.

Security commits:

• Patch commit b59f707
• Patch commit fc7bc2f

Workarounds

• If immediate patching is not possible, consider temporarily disabling staff user password reset functionality
• Implement additional network-layer access controls to restrict Ghost admin panel access
• Monitor staff account authentication activity closely until patches can be applied
• Consider implementing additional authentication mechanisms at the infrastructure level (e.g., VPN, IP allowlisting)

# Configuration example - Restrict Ghost admin access by IP (nginx)
location /ghost/ {
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    proxy_pass http://localhost:2368;
}