GitHub Advisoryadvisory · Packagist

GHSA-93qh-5269-9wcf Statamic: Account takeover via OAuth email matching without email-verification check

HIGH Published 2026-08-06 Modified 2026-08-06 Official page ↗
Aliases
CVE-2026-64665
Ecosystem
Packagist
Packages
statamic/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-290
Reviewed
2026-08-06

Affected packages

• Packagist statamic/cms: < 5.74.1 → fixed in 5.74.1 • Packagist statamic/cms: >= 6.0.0, < 6.24.0 → fixed in 6.24.0

Description

Impact When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a provider. Patches Fixed in 5.74.1 and 6.24.0. Workarounds Only enable OAuth with providers that guarantee verified email addresses, or disable OAuth login.

Related

Alias · CVE (1)

  • CVE-2026-64665 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-290 Authentication Bypass by Spoofing weakness

References