Description

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T22:16:38.850Z",
  "pubdate": "2026-08-21T22:16:38.850Z",
  "executiveSummary": "CrossWatch (CW) prior to version 0.9.21 suffers from an unauthenticated sensitive data exposure vulnerability affecting the session management architecture. Specifically, the GET /api/app-auth/status endpoint lacks proper access control validation, allowing remote unauthenticated network attackers to query and enumerate sensitive metadata belonging to all active user sessions.\nThe exposed data structure includes the other_sessions array, which divulges high-value telemetry such as originating IP addresses, User-Agent strings, internal session identifiers, as well as precise session creation and expiry timestamps. This unauthorized information disclosure significantly impacts confidentiality, granting malicious actors detailed intelligence regarding active system users and network topologies.\nThe risk implications are severe as the leaked internal session IDs and associated metadata can facilitate targeted reconnaissance, session hijacking vectors, or correlation attacks against authenticated users. Exploitation requires zero privileges and no prior authentication, meaning any adversary with network reachability to the application can successfully query the endpoint.\nRemediation requires upgrading CrossWatch to version 0.9.21 or later, which implements the necessary authentication checks to restrict access to the vulnerable API route.",
  "technicalDetails": "The vulnerability resides within the session status verification component of CrossWatch (CW), specifically localized to the GET /api/app-auth/status HTTP endpoint. The root cause of the vulnerability is an absence of authentication and authorization enforcement mechanisms on the route, permitting unvalidated incoming requests to bypass access control checks.\nFrom a component and exposure perspective, the affected HTTP route is exposed directly over the network to any unauthenticated attacker. The endpoint fails to validate whether the requesting HTTP client possesses a valid session token, cookie, or cryptographic credential before servicing the request.\nWhen an unauthenticated network attacker sends a standard GET request to /api/app-auth/status, the underlying application logic processes the request without verification. Instead of rejecting the query due to a lack of credentials, the application queries the session store and serializes the state of all currently active sessions into the HTTP response body.\nThe resulting JSON payload explicitly returns the other_sessions array. This array contains granular forensic metadata for every active user session currently maintained by the synchronization engine. The exposed attributes include originating IP addresses, detailed User-Agent strings revealing client browser and operating system profiles, internal session IDs utilized by the backend state management, and exact creation and expiry timestamps.\nRegarding attack flow, the exploitation process is trivial and direct: 1) The attacker identifies a target instance of CrossWatch running a vulnerable version prior to 0.9.21. 2) The attacker issues an unauthenticated HTTP GET request to the target URI /api/app-auth/status. 3) The application responds with HTTP 200 OK containing the unmasked other_sessions data structure. 4) The attacker harvests the internal session identifiers and client metadata for subsequent adversarial maneuvers.\nThe post-exploitation impact includes advanced reconnaissance capabilities, enabling adversaries to map active user footprints, target specific internal IP ranges discovered in the session metadata, or attempt session fixation and hijacking attacks using the leaked internal session IDs. Affected versions strictly encompass all builds prior to version 0.9.21."
}