Laravel
CVE-2026-27593
CRITICAL
GHSA-jxq9-79vj-rgvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker knows victim email address
-
DeliveryTrigger password reset for victim account
-
ExploitAttacker intercepts reset token from email
-
ExecutionVictim clicks malicious link
-
PersistAttacker captures token and resets password
-
ImpactGains unauthorized account access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password recovery security
|
| Exploitation Conditions | Attacker must know valid email address of Statmatic user account. Victim must click password reset link in email. Vulnerability affects Statmatic versions before 6.3.3 and 5.73.10 with password reset feature enabled. |
| Impact | CVSS 9.3. Admin account takeover through password reset poisoning in a CMS. |
| Exploit ScenarioDerived | Attacker submits password reset for admin email with manipulated Host header, admin receives reset link pointing to attacker's domain, attacker captures the reset token. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Password reset poisoning in Statamic CMS before 6.3.3/5.73.10 allows attackers to steal password reset tokens by manipulating the Host header in reset requests. Patch available.
Earlier versions of this analysis (1)
Password reset token theft via Host header poisoning in Statamic CMS.
RemediationAI
Update Statamic. Configure APP_URL and ignore Host headers for URL generation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-640 weak password recovery mechanism. Attacker manipulates the Host header in password reset requests, causing reset links to point to attacker-controlled domain.
Know when Laravel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.
Executive ViewAI
A critical vulnerability in Statmatic's password reset feature allows attackers to hijack user accounts by intercepting password reset tokens, potentially compromising administrative access and sensitive content across affected installations. Organizations using Statmatic versions prior to 6.3.3 or 5.73.10 face immediate risk of unauthorized account takeover and data breach.
Apply vendor patch. If immediate patching is not possible: disable password reset functionality through application configuration or database modifications; implement WAF rules to block password reset endpoint requests from external networks; require multi-factor authentication for administrative accounts; enable enhanced logging and monitoring on all authentication and account management functions; restrict password reset feature access to specific internal IP ranges only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera
Laravel TokenGuard authentication bypass is a genuine high-priority issue, not an inflated CVSS score: unauthenticated a
Exploit-DB