CVE-2026-53497

This vulnerability in CrossWatch exposes a session enumeration endpoint at `/api/app-auth/status` that returns full session metadata — including IP addresses, User-Agent strings, session IDs, and creation/expiry timestamps — without any authentication. The critical failure isn't merely a missing auth guard; it's that this endpoint should never have existed in its current form for unauthenticated users. The `other_sessions` field reveals a developer treating session metadata as internal debugging telemetry rather than sensitive personal data, and that assumption migrated unchecked into production. The CVSS 5.3 score fundamentally misrepresents the actual risk. Individually, each session's metadata might appear low-severity, but the ability to enumerate ALL active sessions transforms this from information disclosure into a reconnaissance platform. Session IDs combined with originating IPs and timestamps enable targeted session hijacking, device fingerprinting, and temporal profiling — mapping peak session creation times to identify windows for credential stuffing at scale. CVSS was designed to capture impact vectors legible in 2005 (data corruption, availability) and systematically underweights modern reconnaissance-heavy attack chains where combinatorial intelligence matters more than any single disclosure. The deeper failure is architectural: session enumeration should not be possible even with valid credentials. This isn't just a missing middleware guard or a routing misconfiguration — it's a design where session introspection escaped its intended debugging scope and became surface exposure. The fix path matters: if the patch added authentication, the vulnerability was a guard gap. If it removed `other_sessions` from the response, it was data scoping. If it removed the endpoint entirely, they've admitted this endpoint should never have existed. Each tells a different story about root cause. Check your CrossWatch deployment for `/api/app-auth/status` and verify what data it returns — even behind authentication, question whether any endpoint should enumerate other users' sessions. Treat any session introspection capability as deprecated debugging infrastructure that needs explicit removal, not just access control.

Reviewed through automated stages and approved by a human before publication.