CVE-2026-70594: Ghost CMS Authentication Bypass Vulnerability

CVE-2026-70594 Overview

CVE-2026-70594 is a session fixation vulnerability [CWE-384] in Ghost, a Node.js content management system. From version 2.2.0 through 6.54.0, Ghost Admin failed to invalidate existing sessions upon user login. An attacker could reuse a pre-authentication session identifier after a victim authenticated, effectively hijacking the authenticated session. Exploitation requires a secondary vulnerability on the same domain hosting Ghost Admin to plant or fixate the session cookie. The issue is fixed in Ghost version 6.54.1.

Critical Impact
A successful session fixation attack against Ghost Admin yields authenticated administrative access, exposing site content, user data, and configuration to a remote adversary.

Affected Products

Ghost (Node.js CMS) versions 2.2.0 through 6.54.0
Ghost Admin interface (session management component)
Fixed in Ghost version 6.54.1

Discovery Timeline

2026-08-04 - CVE-2026-70594 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70594

Vulnerability Analysis

Ghost Admin's authentication flow reused the pre-login session object when transitioning an anonymous visitor to an authenticated user. The createSessionForUser function in ghost/core/core/server/services/auth/session/session-service.js attached user identity to the existing session rather than regenerating a fresh session identifier. This behavior enables session fixation, classified under [CWE-384].

An adversary who can set a cookie on the Ghost Admin domain (through a related XSS, subdomain takeover, or cookie-injection weakness) can pre-plant a known session ID. When the victim logs in, Ghost binds that attacker-known session ID to the victim's authenticated identity, granting the attacker administrative access.

Root Cause

The root cause is missing session regeneration on privilege change. Secure session handling requires that the session identifier be rotated whenever the authentication boundary is crossed. The vulnerable code retrieved the existing session and mutated it in place, preserving the pre-authentication identifier.

Attack Vector

Exploitation requires a chained precondition: the attacker needs another vulnerability on the Ghost Admin domain that allows setting or reading a session cookie. Delivery typically occurs via a crafted link or adjacent-network cookie injection, followed by tricking an administrator into logging in. Once the victim authenticates, the fixed session ID becomes fully privileged.

javascript

// Patch from Ghost commit 6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c
// File: ghost/core/core/server/services/auth/session/session-service.js

     * @returns {Promise<void>}
     */
    async function createSessionForUser(req, res, user) {
-        const session = await getSession(req, res);
+        const previousSession = await getSession(req, res);
+
+        // Carried over to the new session so verification state survives login
+        const {
+            user_id: previousUserId,
+            verified: previousVerified,
+            auth_code_challenge: previousAuthCodeChallenge,
+            auth_code_generated_at: previousAuthCodeGeneratedAt
+        } = previousSession;
+
+        // Ensure a new session is always created
+        await new Promise((resolve, reject) => {
+            req.session.regenerate((err) => {
+                if (err) {
+                    reject(err);
+                    return;
+                }
+                resolve();
+            });
+        });
+
+        const session = req.session;
+        session.user_id = previousUserId;
+        // A different user doesn't inherit the previous user's verification
+        session.verified = previousUserId && previousUserId !== user.id ? undefined : previousVerified;
+        session.auth_code_challenge = previousAuthCodeChallenge;

Source: Ghost commit 6b1c85c. The patch introduces an explicit req.session.regenerate() call so that every login produces a new session identifier while carrying forward only the fields required for post-login verification.

Detection Methods for CVE-2026-70594

Indicators of Compromise

Ghost Admin session cookies whose identifier does not change across a login boundary in access logs.
Successful /ghost/api/admin/session/ authentication events immediately following anonymous requests sharing the same session cookie value.
Unexpected administrator activity originating from client fingerprints that were previously unauthenticated on the same session ID.

Detection Strategies

Correlate pre-login and post-login requests by session cookie value to identify sessions that persist across authentication events.
Alert on Ghost instances still running versions between 2.2.0 and 6.54.0 by inventorying the package.json version string or the /ghost/api/admin/site/ endpoint response.
Review reverse-proxy or WAF logs for cookie-setting requests originating from cross-site contexts targeting the Ghost Admin domain.

Monitoring Recommendations

Monitor administrative logins for anomalous source IPs, user agents, or geolocations that do not match the account's baseline.
Track any concurrent use of the same session ID from multiple client fingerprints, which indicates a hijacked session.
Ingest Ghost application logs into a centralized SIEM and retain them for post-incident analysis.

How to Mitigate CVE-2026-70594

Immediate Actions Required

Upgrade Ghost to version 6.54.1 or later on all self-hosted instances.
Invalidate all active Ghost Admin sessions after upgrade to force re-authentication and discard any fixated identifiers.
Rotate administrator credentials and API keys if suspicious login activity is observed.
Audit the Ghost Admin domain for auxiliary vulnerabilities (XSS, subdomain takeover) that could enable cookie injection.

Patch Information

The fix is released in Ghost v6.54.1 via pull request #29634 and commit 6b1c85c. Full details are documented in GitHub Security Advisory GHSA-7mpp-r37j-x5wh and the Ghost v6.54.1 release notes. The patch calls req.session.regenerate() during login to guarantee a fresh session identifier.

Workarounds

Restrict access to the Ghost Admin interface using network-level controls such as VPN or IP allowlisting until the patch is applied.
Serve Ghost Admin from a dedicated domain isolated from user-controlled subdomains to reduce cookie-injection surface.
Enforce short session lifetimes and require administrators to re-authenticate frequently.

bash

# Upgrade a self-hosted Ghost instance to the patched version
ghost update --v 6.54.1

# Verify the running version after upgrade
ghost ls

# Optional: force logout of all admin sessions by restarting the process
ghost restart