What is the CVSS score of CVE-2026-64665?

CVE-2026-64665 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Statamic CMS are affected by CVE-2026-64665?

Statamic CMS contains a critical account takeover vulnerability affecting versions before 5.74.1 and 6.24.0 that allows unauthenticated attackers to compromise any user account, including…. A patch is available.

How to fix or mitigate CVE-2026-64665?

Within 24 hours: identify and inventory all Statamic CMS instances running versions 5.x before 5.74.1 or 6.x before 6.24.0 with OAuth functionality enabled, and document which OAuth providers are configured. Within 7 days: apply vendor patches upgrading to Statamic 5.74.1 or 6.24.0 respectively on all affected instances. Within 30 days: conduct comprehensive audit of user account activity and administrative actions post-deployment to detect any unauthorized access or system modifications that may have occurred.

Statamic CMS CVE-2026-64665

EUVD-2026-54232 HIGH

Improper Authentication (CWE-287)

2026-08-06 https://github.com/statamic/cms

GHSA-93qh-5269-9wcf

Authentication Bypass

8.1

CVSS 3.1 · Vendor: https://github.com/statamic/cms

Severity by source

Vendor (https://github.com/statamic/cms) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AC:H reflects the required non-default configuration (OAuth explicitly enabled with an unverified-email provider); PR:N because no Statamic credentials are needed.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/statamic/cms).

CVSS VectorVendor: https://github.com/statamic/cms

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 20:06 vuln.today

Analysis Generated

Aug 06, 2026 - 20:06 vuln.today

CVE Published

Aug 06, 2026 - 19:25 github-advisory

HIGH 8.1

DescriptionCVE.org

Impact

When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user - potentially including a super admin - without their password. Exploitation requires OAuth to be explicitly enabled with such a provider.

Patches

Fixed in 5.74.1 and 6.24.0.

Workarounds

Only enable OAuth with providers that guarantee verified email addresses, or disable OAuth login.

AnalysisAI

Account takeover in Statamic CMS allows unauthenticated network attackers to authenticate as any existing user - including super admins - by exploiting email-based OAuth user matching against providers that do not guarantee verified email addresses. Affected are all Statamic 5.x releases before 5.74.1 and all 6.x releases before 6.24.0 when OAuth is explicitly enabled with an untrusted provider. No public exploit code has been identified at time of analysis, but the published patch diff (PR #14887) fully discloses the vulnerable code path, materially lowering the barrier for independent exploit development.

Technical ContextAI

Statamic CMS (composer package statamic/cms) is a Laravel-based flat-file and Eloquent CMS using Laravel Socialite for third-party OAuth integration. The vulnerable code resided in src/OAuth/Provider.php in the findOrCreateUser() method, which performed a two-step user lookup: first by OAuth provider user ID, then by the email address returned in the OAuth token. CWE-287 (Improper Authentication) applies because the system accepted email identity claims from OAuth providers without verifying that those providers guarantee email ownership - allowing any provider-controlled email value to resolve to an existing Statamic account. A parallel flaw in OAuthController.php allowed new user creation with an already-claimed email. The fix introduces a trustsEmails() method backed by a statamic.oauth.trusted_providers configuration key (defaulting to google, github, apple, bitbucket, slack, slack-openid, twitter-oauth-2), so only explicitly trusted providers may drive email-based user matching, and untrusted providers are blocked from creating accounts that collide with existing emails.

RemediationAI

Upgrade to Statamic CMS 5.74.1 (5.x track) or 6.24.0 (6.x track); both releases are confirmed available at the GitHub release tags referenced above and via Composer. If immediate patching is not possible, two workarounds eliminate the attack surface: first, restrict the OAuth provider list to providers that guarantee verified email addresses - the patched code's default trusted set includes Google, GitHub, Apple, Bitbucket, Slack, Slack-OpenID, and Twitter OAuth 2 - by removing any custom or unlisted providers from the statamic.oauth.providers configuration; second, disable OAuth login entirely by setting statamic.oauth.enabled to false in config/statamic/oauth.php. Both workarounds carry no impact on local username/password authentication flows. The patch is documented at https://github.com/statamic/cms/pull/14887.