CVE-2026-72780

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72780
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72780.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72780
Aliases
Published
2026-08-11T12:17:15Z
Modified
2026-08-30T03:30:30Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
Details

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-294"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72780.json"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
04755d93f86d07cc183db47db8a0eee106892e30
Fixed
f781aecea946641c1c66baa5cf4a39872f99e7c6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.10.5"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72780.json"