CVE-2026-71293

Name of the Vulnerable Software and Affected Versions Statamic CMS (affected versions not specified)

Description The user-augmentation resolver AugmentedUser::get() in src/Auth/AugmentedUser.php contains a case for the two factor recovery codes handle that returns raw two-factor recovery codes without access restrictions. Unlike passwords, these codes are not excluded from augmentation and are not included in the Antlers variable guard lists, which typically only protect config.app.key. If dynamic template rendering is enabled for a field at the blueprint level, an attacker can use a template like {{ current user.two factor recovery codes }} to render the user's recovery codes directly into the HTML response. This allows an attacker who can view or capture the response to obtain the codes and bypass two-factor authentication (2FA). Exploitation depends on dynamic Antlers rendering being enabled via blueprint configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.