CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8
https://www.vulncheck.com/advisories/craft-cms-before-webauthn-assertion-replay-via-login-with-passkey

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Craft CMS anterior a la versión 5.10.5 no logra persistir los contadores de credenciales actualizados después de la validación de aserción de WebAuthn en el punto final de inicio de sesión con clave de acceso. Los atacantes pueden reenviar cuerpos de solicitud de inicio de sesión capturados que contienen requestOptions y response para crear sesiones autenticadas adicionales para cuentas de víctimas.

Information

Published : 2026-08-11 13:19

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72780

Mitre link : CVE-2026-72780

CVE.ORG link : CVE-2026-72780

JSON object : View

Products Affected

No product.

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2026-72780", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72780", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T18:04:35.322870Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.10.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.5", "versionType": "semver"}], "packageURL": "pkg:composer/craftcms/cms", "defaultStatus": "unaffected"}]}], "published": "2026-08-11T13:19:08.510", "references": [{"url": "https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/craft-cms-before-webauthn-assertion-replay-via-login-with-passkey", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts."}, {"lang": "es", "value": "Craft CMS anterior a la versi\u00f3n 5.10.5 no logra persistir los contadores de credenciales actualizados despu\u00e9s de la validaci\u00f3n de aserci\u00f3n de WebAuthn en el punto final de inicio de sesi\u00f3n con clave de acceso. Los atacantes pueden reenviar cuerpos de solicitud de inicio de sesi\u00f3n capturados que contienen requestOptions y response para crear sesiones autenticadas adicionales para cuentas de v\u00edctimas."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}