CVE-2026-103279: Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-06
Weakness: CWE-613

Description

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.

Affected products

TryGhost Ghost: from 3.10.0 before 6.34.0 — fixed in 6.34.0

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.34.0. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-v9vj-6fq5-99xj
https://www.vulncheck.com/advisories/ghost-3.10.0-before-6.34.0-session-invalidation-bypass

Get alerted when CVE-2026-103279 or the next vulnerability affects your stack