CVE-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
Attackers with stolen session cookies can maintain account access after password changes due to incomplete session invalidation in Ghost CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103279?
CVE-2026-103279 is a high-severity authentication bypass vulnerability in TryGhost Ghost, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
Weakness: CWE-613
Which versions are affected by CVE-2026-103279?
1 open source package ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 3.10.0 | 6.34.0 |
How do I fix CVE-2026-103279?
Upgrade ghost to 6.34.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-103279 being exploited?
There is no known exploitation of CVE-2026-103279 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-103279, GHSA-v827-452p-mh2j, GHSA-v9vj-6fq5-99xj.