CVE-2026-45013: ApostropheCMS Auth Bypass Vulnerability

CVE-2026-45013 Overview

CVE-2026-45013 is a host header injection vulnerability in ApostropheCMS, an open-source Node.js content management system. The flaw affects versions up to and including 4.29.0. The password reset flow constructs reset URLs using req.hostname, which is derived from the attacker-controlled HTTP Host header when apos.baseUrl is not explicitly configured. An unauthenticated attacker who knows a target email address can trigger a reset email containing a link pointing to an attacker-controlled domain. When the victim clicks the link, the valid reset token is exfiltrated, enabling full account takeover. The vulnerability is classified under [CWE-20] Improper Input Validation.

Critical Impact
Unauthenticated attackers can hijack password reset tokens and take over arbitrary ApostropheCMS accounts, including administrative accounts, by manipulating the HTTP Host header.

Affected Products

ApostropheCMS versions up to and including 4.29.0
Deployments where apos.baseUrl is not explicitly configured
Node.js-based CMS instances using the default password reset workflow

Discovery Timeline

2026-06-12 - CVE-2026-45013 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45013

Vulnerability Analysis

The vulnerability resides in the ApostropheCMS password reset workflow. When a user submits a password reset request, the application generates a one-time reset token and constructs a URL embedding that token. The host portion of this URL is taken from req.hostname, an Express property that reflects the value supplied by the client in the HTTP Host header. When the administrator has not set apos.baseUrl to a trusted absolute URL, the application accepts whatever host string the attacker provides.

The reset email is then sent to the legitimate account owner, but the embedded link points to the attacker's domain. The attacker captures the token by hosting a listener on that domain. With the valid token, the attacker completes the reset flow against the real ApostropheCMS instance and seizes the account. The flow requires user interaction in the form of the victim clicking the link, but no prior authentication or session context is needed by the attacker.

Root Cause

The root cause is trusting an unauthenticated, attacker-influenced input (Host header) when generating security-sensitive URLs. The application lacks a configured trusted base URL fallback and performs no allowlist validation on the inbound host value before composing the reset link.

Attack Vector

The attacker sends a crafted POST request to the password reset endpoint containing the victim's email and a forged Host header pointing to an attacker-controlled domain. The server emails the victim a reset link constructed from that host. The victim, seeing a legitimate-looking message from their CMS, clicks the link, transmitting the reset token to the attacker. The attacker then uses the token to set a new password on the real ApostropheCMS server. See the GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-45013

Indicators of Compromise

Password reset requests in web server logs where the Host header does not match the canonical site domain.
Outbound password reset emails containing links to unexpected or unknown domains.
Multiple reset requests targeting the same account from a single source IP within a short window.
DNS or proxy logs showing clients accessing reset URLs on domains outside the organization's allowlist.

Detection Strategies

Inspect reverse proxy and load balancer logs for Host header values that deviate from approved hostnames.
Parse mail server outbound queues for password reset links and validate that the URL host matches the configured CMS domain.
Implement WAF rules that reject password reset requests when the Host header is not in an allowlist.

Monitoring Recommendations

Forward Apostrophe application logs, reverse proxy logs, and mail logs to a centralized SIEM with correlation rules.
Alert on anomalous Host header values reaching the /api/v1/@apostrophecms/login/reset endpoint or equivalent reset routes.
Track repeated reset requests per email address and per source IP to identify enumeration attempts.

How to Mitigate CVE-2026-45013

Immediate Actions Required

Explicitly configure apos.baseUrl in the ApostropheCMS configuration to a trusted absolute URL so reset links are built from a fixed origin.
Configure the reverse proxy or load balancer to reject or normalize requests with unexpected Host headers before they reach the application.
Audit recent password reset events and outbound emails for signs of abuse, and force-reset any accounts where suspicious activity is identified.

Patch Information

As of the time of publication, no patched version of ApostropheCMS is available. Refer to the GitHub Security Advisory GHSA-gf43-24g3-5hw2 for the latest remediation status and any released fixes.

Workarounds

Set apos.baseUrl to the canonical site URL in every environment so the reset flow does not rely on req.hostname.
Deploy a strict Host header allowlist at the reverse proxy (for example, Nginx server_name enforcement or an HAProxy ACL).
Temporarily disable the self-service password reset feature and process resets through an administrator channel until a vendor patch ships.

bash

# Configuration example: enforce a fixed baseUrl in ApostropheCMS
# app.js
require('apostrophe')({
  shortName: 'my-site',
  baseUrl: 'https://www.example.com',
  modules: {
    // module configuration
  }
});

# Nginx Host header allowlist
server {
  listen 443 ssl;
  server_name www.example.com;

  if ($host !~* ^(www\.example\.com)$) {
    return 444;
  }

  location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
  }
}