ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Description

No description available.

Recommendation

Update the apostrophe package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.27.1
• Patched version(s): 4.28.0

References

• GHSA-v9xm-ffx2-7h35
• CVE-2026-32730
• CWE-287
• CWE-305
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API - CVE-2026-33888
• ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictio - CVE-2026-39857
• Parse Server has an MFA single-use token bypass via concurrent authData login requests - CVE-2026-34224
• ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context - CVE-2026-33889

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

apostrophe