CVE-2026-112775 in Craft CMS
Summary
by MITRE • 10/19/2026
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions prior to 5.11.0 contain a critical authentication bypass vulnerability within its user management module that stems from improper invalidation of verification tokens. The core technical flaw resides in the logic governing the users/verify-email endpoint, which fails to invalidate existing email change verification codes once an active user has successfully verified their new email address. In standard secure implementations, any previously issued token for a specific action should be immediately revoked upon successful completion or expiration to prevent replay attacks. However, in this vulnerable version of Craft CMS, the system retains these tokens as valid even after the initial verification process is complete. This design oversight creates a window where stale authentication credentials remain active and usable by anyone who possesses them, fundamentally undermining the integrity of the account recovery and email change workflows.
The operational impact of this vulnerability allows an attacker to perform a password reset attack against targeted user accounts without needing access to the victim's current inbox for new codes. If an attacker can intercept or obtain a verification code sent during an initial email change request—perhaps through network sniffing, log exposure, or social engineering—they can wait until the legitimate user completes their own email verification process. Once that step is finalized by the victim, the system incorrectly considers the previously intercepted code still valid for subsequent actions. The attacker then submits this old verification code to the users/set-password endpoint. Because the system does not recognize that the token should have been invalidated upon the prior successful verification, it accepts the code and proceeds with resetting the account password. This effectively allows the attacker to take full control of the victim's account by establishing a new password known only to them.
This vulnerability aligns closely with CWE-294, which describes Improper Authentication Bypass via Capture of Authentication Credentials, as well as CWE-613, Insufficient Session Expiration. From an adversarial perspective, this behavior maps directly to the MITRE ATT&CK technique T1078, Valid Accounts, specifically within the context of account manipulation and credential reset abuse. The flaw exploits a race condition-like state where the lifecycle management of security tokens is not strictly enforced across related but distinct authentication steps. This lack of strict token scoping allows for replay attacks that bypass multi-factor verification expectations inherent in email-based confirmation processes.
Mitigation strategies must prioritize immediate software updates to version 5.11.0 or later, where this logic has been corrected to ensure tokens are invalidated upon successful use regardless of subsequent user actions. For organizations unable to patch immediately due to compatibility constraints, temporary mitigations should focus on restricting access to the users/verify-email and users/set-password endpoints through web application firewall rules if possible, although this is less effective than a code fix. Additionally, administrators should enforce strict logging monitoring for unusual patterns in password reset requests and email verification activities. Implementing short-lived token expiration policies and ensuring that any successful authentication action immediately revokes all related pending tokens are essential best practices to prevent similar vulnerabilities in future development cycles. Regular security audits of identity management modules are recommended to ensure compliance with industry standards such as NIST SP 800-63B regarding digital identity guidelines for authentication and lifecycle management.