medium6.8
CVE-2026-103279
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change.
Impact
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
Affected products
| Product | Affected versions |
|---|---|
| Ghost Versions From 3.10.0 | before 6.34.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.