statamic/cms · Security
Statamic: Account takeover via OAuth email matching without email-verification check
- GHSA ID
- GHSA-93qh-5269-9wcf
- CVE ID
- CVE-2026-64665
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Impact
When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a provider.
Patches
Fixed in 5.74.1 and 6.24.0.
Workarounds
Only enable OAuth with providers that guarantee verified email addresses, or disable OAuth login.
CWEs
- CWE-287 · Improper Authentication
- CWE-290 · Authentication Bypass by Spoofing
References
- https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf ↗
- https://github.com/statamic/cms/pull/14887 ↗
- https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a ↗
- https://github.com/statamic/cms/releases/tag/v5.74.1 ↗
- https://github.com/statamic/cms/releases/tag/v6.24.0 ↗
- https://github.com/advisories/GHSA-93qh-5269-9wcf ↗