PT-2026-24603 · Bitnami · Ghost
Published
2026-03-10
·
Updated
2026-03-10
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ghost