7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9m84-wc28-w895

GHSA-9m84-wc28-w895: Ghost has incomplete CSRF protections around OTC use

Impact

Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.

Vulnerable versions

This vulnerability is present in Ghost from v5.101.6 up to v6.19.2.

Patches

v6.19.3 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here.

For more information

If there are any questions or comments about this advisory, send an email to security@ghost.org.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9m84-wc28-w895

GHSA-9m84-wc28-w895:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ghost	npm	>= 5.101.6, <= 6.19.2	6.19.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-9m84-wc28-w895, is a Cross-Site Request Forgery (CSRF) weakness in Ghost's authentication flow. The root cause was the failure to bind one-time codes (OTCs), used for two-factor authentication (2FA), to the specific session in which they were generated. An attacker could phish a user for their OTC and then use that code in their own separate browser session to take over the victim's account.

The analysis of the patch commit ec065a774fa125953d2aa644a59cd8990329e0a0 reveals several key changes to fix this. The core of the fix is in ghost/core/core/server/services/auth/otp.js, where the verify function was modified to accept a context parameter. This context, which is a unique challenge string stored in the user's session, is now concatenated with the secret and user ID during token generation and verification. This ensures a token is only valid within the session it was created for.

Several functions in ghost/core/core/server/services/auth/session/session-service.js were consumers of this vulnerable logic. The verifyAuthCodeForUser function, which backs the /session/verify endpoint, was patched to enforce an origin check (cookieCsrfProtection) and to use the new session-bound verification logic. Similarly, createSessionForUser was refactored to prevent a session from being improperly verified using a token from another context. These functions are the primary runtime indicators that would appear during exploitation of this vulnerability.

Vulnerable functions

otp.verify

ghost/core/core/server/services/auth/otp.js

The `otp.verify` function was vulnerable because it only used the user's ID and a shared secret to validate a one-time code (OTC). It did not include any session-specific context. This flaw allowed an OTC generated for a user in one browser session to be successfully used in a different session, leading to a cross-session token capture and account takeover.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.