EUVD-2026-56104
GHSA-jh4m-63fq-p9h9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H requires prior capture of victim's login body; PR:N as no Craft credentials are needed to replay; UI:R since victim must first perform a successful login.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.
AnalysisAI
Passkey authentication in Craft CMS before 5.10.5 is vulnerable to WebAuthn assertion replay, enabling an attacker who obtains a captured login request body to create additional authenticated sessions for a victim account without possessing the passkey device. The root cause is a dual failure at the users/login-with-passkey endpoint: the server accepts client-supplied PublicKeyCredentialRequestOptions - bypassing server-generated challenge binding - and never persists the updated credential counter after assertion validation, leaving it permanently stale. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be met for exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) captures the high confidentiality impact of full session takeover but assigns AC:L and AT:N, which somewhat understates the real-world attacker preconditions: obtaining a valid passkey login POST body requires meaningful prior positioning - access to application request logs, a debugging proxy on the victim's network path, a compromised browser extension, or a logging analytics layer - making this materially harder than a straightforward AC:L network-exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to application request logs or a network debugging proxy on the victim's traffic path captures the complete POST body of a successful passkey login to `users/login-with-passkey`, including the `requestOptions` and `response` fields. The attacker replays the identical body to the same endpoint; Craft deserializes the attacker-supplied challenge, compares the assertion's signature counter against the permanently stale stored value, and - finding it unchanged - treats the assertion as valid, issuing a new authenticated session for the victim account. … |
| Remediation | Upgrade Craft CMS to version 5.10.5 or later, which includes fix commit d71a66d69cf8852bcfca4484ca718750b5a316d6 that correctly persists the updated `PublicKeyCredentialSource` after assertion validation, consuming the credential counter and invalidating the captured body for future replays. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all Craft CMS 5.x instances with passkey authentication enabled, noting current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today