CVE-2026-64665

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64665", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-20T17:11:30.897Z", "datePublished": "2026-08-06T19:25:01.756Z", "dateUpdated": "2026-08-07T17:09:33.394Z"}, "containers": {"cna": {"title": "Statamic: Account takeover via OAuth email matching without email-verification check", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf"}, {"name": "https://github.com/statamic/cms/pull/14887", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/pull/14887"}, {"name": "https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a"}, {"name": "https://github.com/statamic/cms/releases/tag/v5.74.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v5.74.1"}, {"name": "https://github.com/statamic/cms/releases/tag/v6.24.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v6.24.0"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.74.1", "status": "affected"}, {"version": ">= 6.0.0, < 6.24.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:25:01.756Z"}, "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0."}], "source": {"advisory": "GHSA-93qh-5269-9wcf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T15:26:57.594364Z", "id": "CVE-2026-64665", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:09:33.394Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64665", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T15:26:57.594364Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T15:27:02.682Z"}}], "cna": {"title": "Statamic: Account takeover via OAuth email matching without email-verification check", "source": {"advisory": "GHSA-93qh-5269-9wcf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.74.1"}, {"status": "affected", "version": ">= 6.0.0, < 6.24.0"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf", "name": "https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/statamic/cms/pull/14887", "name": "https://github.com/statamic/cms/pull/14887", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a", "name": "https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v5.74.1", "name": "https://github.com/statamic/cms/releases/tag/v5.74.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v6.24.0", "name": "https://github.com/statamic/cms/releases/tag/v6.24.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:25:01.756Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64665", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:09:33.394Z", "dateReserved": "2026-07-20T17:11:30.897Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T19:25:01.756Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": "< 5.74.1"}, {"status": "affected", "version": ">= 6.0.0, < 6.24.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, cuando el inicio de sesi\u00f3n OAuth estaba habilitado con un proveedor que no garantiza direcciones de correo electr\u00f3nico verificadas, un atacante no autenticado podr\u00eda iniciar sesi\u00f3n como un usuario existente, potencialmente incluyendo un superadministrador, sin conocer la contrase\u00f1a de ese usuario, porque la aplicaci\u00f3n emparejaba las identidades OAuth con las cuentas \u00fanicamente por la direcci\u00f3n de correo electr\u00f3nico. La explotaci\u00f3n requiere que OAuth est\u00e9 expl\u00edcitamente habilitado con dicho proveedor. Este problema est\u00e1 solucionado en las versiones 5.74.1 y 6.24.0."}], "id": "CVE-2026-64665", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64665", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T15:26:57.594364Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:18:14.103", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/pull/14887"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v5.74.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v6.24.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-290"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.74.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.24.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "created": "2026-08-07T00:45:04.372152+00:00", "updated": "2026-08-07T01:45:05.157548+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}