CVE-2026-72780 in Craft CMS

Résumé

par MITRE • 11/08/2026

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsable: VulnCheck
• Réserver: 10/08/2026
• Divulgation: 11/08/2026
• Modérer: accepté
• Entrée: VDB-388128
• CPE: prêt
• CWE: CWE-294 (confirmé)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: très faible
• Secteur: Lawfirm, Hostingprovider, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-72780
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72780
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-72780/