CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)
Unauthenticated attackers can access an API endpoint to leak sensitive session metadata, including IP addresses and session IDs, from CrossWatch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53497?
CVE-2026-53497 is a medium-severity vulnerability in cenodude CrossWatch, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.
Which versions are affected by CVE-2026-53497?
How do I fix CVE-2026-53497?
No fix has been published for CVE-2026-53497 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-53497 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53497 exists.
Sources
Also known as GHSA-rv3j-r4h5-q3cj.