CVE-2026-103279: Tryghost Ghost

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.

Affected products

• Tryghost Ghost: from 3.10.0, before 6.34.0 (fixed in 6.34.0)

Published 2026-10-01. Last modified 2026-10-06.