CVE-2026-72780
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.
Risk Assessment
An attacker could gain unauthorized access to user accounts, potentially leading to confidentiality and integrity breaches. This is a serious risk to account security.
Recommendation
Update Craft CMS to version 5.10.5 or later to ensure proper persistence of credential counters and prevent replay attacks.
Original NVD description (English source)
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.