CVE-2026-70594: CVE-2026-70594: Session Fixation in Ghost Admin Panel

CVE-2026-70594: Session Fixation in Ghost Admin Panel

Vulnerability ID: CVE-2026-70594
CVSS Score: 6.7
Published: 2026-08-04

A critical session fixation vulnerability exists in the Ghost Admin panel from version 2.2.0 until 6.54.1. The Express-based authentication backend fails to invalidate or rotate the session identifier during login, allowing attackers to hijack administrative sessions.

TL;DR

Ghost Admin did not rotate session identifiers upon login. This allowed session fixation attacks, enabling attackers with subdomain or domain-level cookie injection capabilities to hijack administrative sessions.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-384
• Attack Vector: Adjacent Network
• Attack Complexity: High
• CVSS Score: 6.7 (Medium)
• Exploit Status: Proof-of-Concept
• CISA KEV Status: Not Listed

Affected Systems

• Ghost Content Management System (CMS)
• Ghost Admin Panel
• Ghost: >= 2.2.0, < 6.54.1 (Fixed in: 6.54.1)

Code Analysis

Commit: 6b1c85c

Regenerate session on login to prevent session fixation attacks

Exploit Details

• GitHub Advisory Database: The official advisory documents the session fixation scenario requiring a co-hosted/subdomain cookie tossing vector.

Mitigation Strategies

• Upgrade Ghost to version 6.54.1 or newer
• Enforce strict cookie domain and host isolation
• Enable HttpOnly, Secure, and SameSite cookie policies

Remediation Steps:

1. Verify the current Ghost version using the command line
2. Execute the ghost update command to install version 6.54.1 or higher
3. Revoke all active sessions in the backend storage to invalidate existing un-regenerated session cookies

References

• Ghost Session Fixation Patch Commit
• Ghost Security PR 29634
• GitHub Security Advisory GHSA-7mpp-r37j-x5wh
• Ghost v6.54.1 Release Notes
• CVE-2026-70594 Record

---

Read the full report for CVE-2026-70594 on our website for more details including interactive diagrams and full exploit analysis.