Ghost, a Node.js content management system, suffered a session fixation flaw in its admin interface from version 2.2.0 through 6.54.1. The flaw allowed a session identifier to remain valid after a user logged in, meaning an attacker who had pre-set a session cookie could potentially hijack an admin session. Exploitation would also require a separate vulnerability on the same domain to set or manipulate the cookie. The flaw is classified as CWE‑384 and carries a CVSS score of 6.7, indicating moderate severity.

The vulnerability affects TryGhost Ghost applications from release 2.2.0 up to and including 6.54.1. Versions 6.54.1 and newer contain a fix that ensures sessions are invalidated on login.

With a CVSS of 6.7 the risk is moderate; the EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would typically occur via a second vulnerability on the same domain that permits cookie manipulation, making it less likely to be abused in the wild without additional conditions.