CVE-2026-53497: CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)
CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CrossWatch (CW)to a version that resolves this vulnerability.Fixed in 0.9.21
Event History
Frequently Asked Questions
Which deployments are exposed?
CrossWatch deployments running a version earlier than 0.9.21 are exposed if an unauthenticated network attacker can reach the GET /api/app-auth/status endpoint.
Does exploitation require an account or user interaction?
No. The endpoint is accessible without authentication, so an attacker needs only network access to the endpoint; no credentials or user interaction are required.
What information can an attacker obtain?
The response exposes the other_sessions array for active sessions, including originating IP addresses, User-Agent strings, internal session IDs, and session creation and expiry timestamps.
How can I remediate the issue?
Upgrade CrossWatch to version 0.9.21, which fixes the unauthenticated exposure.