CVE-2026-64665

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.1 Statamic versions prior to 6.24.0

Description When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker can sign in as an existing user, including super admins, without knowing the password. This occurs because the application matches OAuth identities to accounts using only the email address.

Recommendations Update to version 5.74.1 or newer. Update to version 6.24.0 or newer. Only enable OAuth with providers that guarantee verified email addresses or disable OAuth login.