p PatchFirst

CVE-2026-70594

CVE-2026-70594 · Ghost: Session Fixation in Ghost Admin

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

CVSS 6.7 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • >= 2.2.0, < 6.54.1: Affected

    No fix published

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 2.2.0, < 6.54.1

    Update to 6.54.1

Original sources

Check your server →