CVE-2026-72780
Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 11, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 10, 2026
Description
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-294 Authentication Bypass by Capture-replay
Affected Products
| Product | Versions |
|---|---|
cmscraftcms |
|
References
- GitHub Security Advisory (GHSA-wg23-69c2-gjc8)vendor-advisory
- VulnCheck Advisory: Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.