CVE-2026-64665

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a
https://github.com/statamic/cms/pull/14887
https://github.com/statamic/cms/releases/tag/v5.74.1
https://github.com/statamic/cms/releases/tag/v6.24.0
https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, cuando el inicio de sesión OAuth estaba habilitado con un proveedor que no garantiza direcciones de correo electrónico verificadas, un atacante no autenticado podría iniciar sesión como un usuario existente, potencialmente incluyendo un superadministrador, sin conocer la contraseña de ese usuario, porque la aplicación emparejaba las identidades OAuth con las cuentas únicamente por la dirección de correo electrónico. La explotación requiere que OAuth esté explícitamente habilitado con dicho proveedor. Este problema está solucionado en las versiones 5.74.1 y 6.24.0.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-64665

Mitre link : CVE-2026-64665

CVE.ORG link : CVE-2026-64665

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-64665", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64665", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T15:26:57.594364Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.74.1"}, {"status": "affected", "version": ">= 6.0.0, < 6.24.0"}]}]}], "published": "2026-08-06T22:18:14.103", "references": [{"url": "https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/pull/14887", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v5.74.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v6.24.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, cuando el inicio de sesi\u00f3n OAuth estaba habilitado con un proveedor que no garantiza direcciones de correo electr\u00f3nico verificadas, un atacante no autenticado podr\u00eda iniciar sesi\u00f3n como un usuario existente, potencialmente incluyendo un superadministrador, sin conocer la contrase\u00f1a de ese usuario, porque la aplicaci\u00f3n emparejaba las identidades OAuth con las cuentas \u00fanicamente por la direcci\u00f3n de correo electr\u00f3nico. La explotaci\u00f3n requiere que OAuth est\u00e9 expl\u00edcitamente habilitado con dicho proveedor. Este problema est\u00e1 solucionado en las versiones 5.74.1 y 6.24.0."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}