EUVD-2026-56104
GHSA-jh4m-63fq-p9h9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H requires prior capture of victim's login body; PR:N as no Craft credentials are needed to replay; UI:R since victim must first perform a successful login.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.
AnalysisAI
Passkey authentication in Craft CMS before 5.10.5 is vulnerable to WebAuthn assertion replay, enabling an attacker who obtains a captured login request body to create additional authenticated sessions for a victim account without possessing the passkey device. The root cause is a dual failure at the users/login-with-passkey endpoint: the server accepts client-supplied PublicKeyCredentialRequestOptions - bypassing server-generated challenge binding - and never persists the updated credential counter after assertion validation, leaving it permanently stale. No public exploit code has been identified at time of analysis, though the GHSA advisory documents a complete step-by-step attack scenario; organizations with passkey authentication enabled in Craft CMS 5.x should treat the vendor-released patch (5.10.5) as urgent.
Technical ContextAI
WebAuthn (Web Authentication API) provides phishing-resistant authentication through two server-enforced replay safeguards: a server-generated cryptographic challenge that must be echoed in every assertion (ensuring freshness), and a monotonically increasing signature counter stored server-side that must exceed the previously recorded value on each login (ensuring each assertion is consumed exactly once). Craft CMS 5.x (CPE: cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*) violates both mechanisms at the unauthenticated POST endpoint users/login-with-passkey. First, it deserializes PublicKeyCredentialRequestOptions directly from the client-controlled request body, allowing an attacker to supply a challenge from a previously captured assertion rather than a server-issued one. Second, it does not call the persistence method on the PublicKeyCredentialSource returned by the web-auth/webauthn-lib library after successful assertion, so the stored signature counter remains at its original stale value across all subsequent logins. CWE-294 (Authentication Bypass by Capture-Replay) precisely characterizes this root cause: the protocol's one-time-use guarantees are nullified because server-side state is never updated.
RemediationAI
Upgrade Craft CMS to version 5.10.5 or later, which includes fix commit d71a66d69cf8852bcfca4484ca718750b5a316d6 that correctly persists the updated PublicKeyCredentialSource after assertion validation, consuming the credential counter and invalidating the captured body for future replays. The vendor security advisory is at https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8. If immediate upgrade is not feasible, the most effective compensating control is to disable the passkey login feature entirely at the application or WAF level, which eliminates the vulnerable endpoint at the cost of forcing affected users back to password-based or TOTP authentication flows. Additionally, audit all request logging infrastructure, debugging proxies, browser extensions, and analytics integrations that may be capturing raw POST bodies from the users/login-with-passkey endpoint, and invalidate all existing Craft sessions for accounts that use passkeys to close any sessions that may have already been created through replay. No workaround preserves passkey functionality without patching.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today