Résumé
Statamic: Account takeover via OAuth email matching without email-verification check
Détails de l’avis
Impact
When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a provider.
Patches
Fixed in 5.74.1 and 6.24.0.
Workarounds
Only enable OAuth with providers that guarantee verified email addresses, or disable OAuth login.
Références
- https://github.com/advisories/GHSA-93qh-5269-9wcf
- https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf
- https://github.com/statamic/cms/pull/14887
- https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a
- https://github.com/statamic/cms/releases/tag/v5.74.1
- https://github.com/statamic/cms/releases/tag/v6.24.0
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-73840
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
- HIGHCVE-2026-59224
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
- HIGHCVE-2026-72809
SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy
- HIGHCVE-2026-62669
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
- HIGHCVE-2026-77567
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
- MEDIUMCVE-2026-55678
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset