CVE-2026-72780 in Craft CMS
Summary
by MITRE • 08/11/2026
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability resides within Craft CMS versions prior to 5.10.5 where the authentication system fails to properly validate and persist credential counter updates during WebAuthn assertion validation processes. The flaw occurs specifically in the passkey login endpoint where the system accepts and processes login request bodies containing both requestOptions and response data without adequately verifying that credential counters have been properly updated. This represents a critical security weakness that directly impacts the integrity of multi-factor authentication mechanisms.
The technical implementation flaw stems from insufficient validation of WebAuthn credential counter values during authentication flows. When attackers capture legitimate login request bodies containing the necessary requestOptions and response parameters, they can replay these requests multiple times to establish new authenticated sessions for victim accounts. This occurs because the system does not enforce proper credential counter validation that should prevent replay attacks by ensuring that credential usage counters have been incremented appropriately after each successful authentication event.
The operational impact of this vulnerability is severe as it enables unauthorized session hijacking and account takeover scenarios. Attackers can leverage captured authentication payloads to repeatedly authenticate as legitimate users without requiring additional credentials, effectively bypassing the security benefits of WebAuthn passkey authentication. This weakness particularly affects environments where Craft CMS serves as a content management platform for sensitive applications, potentially allowing attackers to gain persistent access to administrative accounts and compromise entire systems.
This vulnerability maps directly to CWE-347 - Improper Verification of Cryptographic Signature and CWE-611 - Improper Restriction of XML External Entity Reference in the context of authentication systems. The flaw also aligns with ATT&CK technique T1566 - Phishing and T1078 - Valid Accounts as it enables attackers to establish persistent authenticated sessions using captured passkey data. Organizations should immediately upgrade to Craft CMS 5.10.5 or later where proper credential counter validation has been implemented to prevent replay attacks and ensure that each authentication event properly increments and validates the WebAuthn credential usage counters.
The mitigation strategy requires immediate deployment of the patched version while implementing additional monitoring for unusual authentication patterns. Security teams should also consider implementing rate limiting and anomaly detection on authentication endpoints to identify potential replay attack attempts. Organizations should conduct comprehensive testing of their WebAuthn implementations to ensure that credential counter validation is properly enforced across all authentication flows, particularly in systems handling sensitive data or privileged accounts where the impact of unauthorized access could be catastrophic.