ApostropheCMS allows a cross-host or cross-locale redirection that embeds a single-use bearer session token in the URL. If a malicious party captures the token before it is consumed, they can redeem it and adopt the original session, effectively hijacking that user's privileges. The flaw exists due to improper handling of the token’s visibility during migration, exposing it to potential interception. Once redeemed, the attacker has full access to the session’s authenticated state, enabling arbitrary actions under the victim’s authority.

The vulnerability affects ApostropheCMS versions prior to 4.33.0 and the passport-bridge package versions earlier than 1.6.1. Only installations using these legacy versions are at risk; later releases contain the fix.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, so the current likelihood of exploitation is unknown. The flaw is not listed in the CISA KEV catalog, implying no confirmed exploits have been reported in the wild. Attackers could leverage the exposed token if they manage to intercept redirect URLs, for instance through network eavesdropping or XSS. The attack surface requires network access to the site and the ability to observe the redirect flow, making it less likely than fully remote exploitation, but still within reach if network visibility is present.