CVE-2026-72780: Craft CMS Auth Bypass Vulnerability

CVE-2026-72780 Overview

CVE-2026-72780 affects Craft CMS versions prior to 5.10.5. The content management system fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers who capture a valid login request body containing requestOptions and response parameters can replay it against the endpoint to create additional authenticated sessions for the victim account. The flaw is categorized as improper authentication [CWE-294] and stems from missing state updates that WebAuthn relies on to detect replayed assertions.

Critical Impact
Attackers with network access to the passkey login endpoint can replay captured WebAuthn assertions to establish unauthorized authenticated sessions as any passkey-enabled user.

Affected Products

Craft CMS versions prior to 5.10.5
Craft CMS installations with passkey (WebAuthn) authentication enabled
Craft CMS login-with-passkey endpoint consumers

Discovery Timeline

2026-08-11 - CVE-2026-72780 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72780

Vulnerability Analysis

Craft CMS supports passwordless authentication using WebAuthn passkeys. During a passkey login, the browser produces an assertion containing a signature over server-supplied challenge data and a monotonically increasing signature counter. The server must validate the signature and persist the new counter value to detect cloned or replayed authenticators.

In versions before 5.10.5, the passkey login endpoint validates the assertion but does not persist the updated counter to the credential record. Because the stored counter never advances, a previously captured request body remains valid on subsequent submissions. Each replay produces a new authenticated session bound to the victim account.

The issue undermines a core WebAuthn security guarantee. The signature counter exists specifically to detect assertion reuse, and skipping the persistence step defeats replay detection entirely.

Root Cause

The root cause is missing state persistence after successful assertion verification [CWE-294]. The endpoint accepts the requestOptions and response fields, validates the signature against the stored credential public key, and issues a session, but omits the database write that would increment and store the credential's signature counter.

Attack Vector

Exploitation requires an attacker to obtain a valid captured request body from a prior successful passkey authentication. Capture vectors include compromised browser extensions, proxied traffic on hostile networks, malicious middleboxes, or exposed logs that record request bodies. Once captured, the attacker POSTs the same body to the passkey login endpoint over the network and receives a fresh session cookie for the victim account. No user interaction is required at exploitation time. The vulnerability requires low privileges because the attacker must first observe or acquire a legitimate authentication payload.

Refer to the GitHub Security Advisory GHSA-wg23-69c2-gjc8 and the VulnCheck advisory for additional technical context.

Detection Methods for CVE-2026-72780

Indicators of Compromise

Multiple successful passkey authentication events for the same user account within a short time window from differing source IP addresses or user agents.
Session creation events whose request bodies contain identical response.clientDataJSON or response.authenticatorData values across separate HTTP requests.
Login events for passkey-enabled accounts where the credential signature counter stored in the database remains static across multiple successful authentications.

Detection Strategies

Enable verbose logging on the Craft CMS passkey login endpoint and hash inbound response payloads. Alert on repeated identical hashes.
Correlate authentication events with source IP, ASN, and user agent to surface impossible-travel or agent-mismatch patterns tied to a single account.
Baseline the WebAuthn signature counter per credential and alert when consecutive authentications do not advance the counter.

Monitoring Recommendations

Forward Craft CMS application and web server logs to a centralized analytics platform for retention and correlation.
Monitor administrator and privileged editor accounts with elevated scrutiny given the potential for content tampering following account takeover.
Track session issuance rates per account and alert on anomalous bursts of new session cookies for the same identity.

How to Mitigate CVE-2026-72780

Immediate Actions Required

Upgrade Craft CMS to version 5.10.5 or later on all production, staging, and development instances.
Invalidate existing authenticated sessions for passkey-enabled users to force fresh logins after patching.
Audit recent authentication logs for the indicators listed above and reset any accounts showing evidence of replay.

Patch Information

The Craft CMS maintainers addressed the vulnerability in version 5.10.5 by persisting the updated WebAuthn credential counter after assertion validation. Deployment details are published in the GitHub Security Advisory GHSA-wg23-69c2-gjc8.

Workarounds

Temporarily disable passkey (WebAuthn) authentication in Craft CMS control panel settings until the 5.10.5 upgrade is deployed.
Restrict access to the Craft CMS control panel by source IP allowlisting at the reverse proxy or WAF layer to limit exposure of the passkey login endpoint.
Enforce TLS with strict transport security and disable request body logging in intermediary proxies to reduce assertion capture opportunities.

bash

# Verify the installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.10.5 --with-all-dependencies
php craft up