CVE-2026-32730CWE-287CWE-305

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

High · published March 18, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00504 · 42.2th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-305 · Authentication Bypass by Primary Weakness
Published
2026-03-18T22:00Z
EPSS history
Timeline
  • 18 MAR 22:00Z
    ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
    cvelistv5