PT-2026-70198 · Craft Cms · Craft Cms

CVE-2026-72780

·

Published

2026-08-07

·

Updated

2026-08-11

CVSS v4.0

7.1

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 5.10.5
Description The software fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. This allows attackers to replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts. WebAuthn is a standard for passwordless authentication using public-key cryptography.
Recommendations Update Craft CMS to version 5.10.5 or later.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2026-72780
GHSA-WG23-69C2-GJC8

Affected Products

Craft Cms