CVE-2026-103279 — Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accoun…
Published: 2026-10-01 · CVSS: 7.6 · CVSS 4.0
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7