CVE-2026-109307

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.13

Description A DOM-based cross-site scripting issue exists in the control panel login and 2FA verification flow. The problem occurs because the returnUrl variable, which is controlled by the user, accepts javascript: URLs during client-side navigation. An attacker can trick a victim who has 2FA enabled into opening a specially crafted '/admin/login?verify=1' endpoint between the password submission and TOTP (Time-based One-Time Password) verification steps. This allows the execution of arbitrary JavaScript within the authenticated control panel using the victim's permissions.

Recommendations Update Craft CMS to version 5.10.14 or later.