A critical authentication bypass vulnerability in ApostropheCMS allows unauthenticated attackers to circumvent multi-factor authentication, potentially leading to full account takeover.

The flaw exists within the bearer token authentication middleware in the @apostrophecms/express package, where an incorrect MongoDB query permits tokens that have passed password verification but failed subsequent TOTP or MFA requirements to be treated as fully authenticated. This bypass affects all deployments utilizing @apostrophecms/login-totp or custom afterPasswordVerified requirements.

The ability to bypass MFA significantly reduces the security posture of the CMS, enabling unauthorized access to administrative functions and sensitive content. With a CVSS score of 8.1, this vulnerability poses a high risk of data exfiltration and complete system compromise, necessitating immediate remediation to prevent unauthorized administrative actions.

Immediate Action: Update the ApostropheCMS package to version 4.28.0 or later to apply the necessary fix to the authentication middleware.

Proactive Monitoring: Review authentication logs for suspicious login patterns or access attempts that appear to bypass expected multi-factor authentication challenges.

Compensating Controls: While no direct WAF rule can fully replace the patch, enforcing strict IP-based access controls for administrative endpoints can limit the attack surface while the update is staged.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of the vulnerability as an authentication bypass, organizations must prioritize upgrading to version 4.28.0 immediately. Failure to patch will leave administrative interfaces vulnerable to account takeover, even for accounts protected by multi-factor authentication.