CVE-2026-72780CWE-294

CVE-2026-72780

Medium · published August 11, 2026

CVSS v3.1

6.5

EPSS

Percentile

31.3

In the wild

Unconfirmed

What it is

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00385 · 31.3th percentile
Weakness: CWE-294 · Authentication Bypass by Capture-replay
Published: 2026-08-11T17:19Z

References (2)

https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8 · [email protected]https://www.vulncheck.com/advisories/craft-cms-before-webauthn-assertion-replay-via-login-with-passkey · [email protected]

EPSS history

Timeline

11 AUG 12:17Z
Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
cvelistv5