CVE-2026-64665

Summary

Statamic: Account takeover via OAuth email matching without email-verification check

Severity

high

CVSS

8.1

EPSS

0.5% (p45)

CWE

CWE-287, CWE-290

Also known as

GHSA-93qh-5269-9wcf

Published

2026-08-06

Updated

2026-08-06

Advisory details

Impact

When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a provider.

Patches

Fixed in 5.74.1 and 6.24.0.

Workarounds

Only enable OAuth with providers that guarantee verified email addresses, or disable OAuth login.

References

• https://github.com/advisories/GHSA-93qh-5269-9wcf
• https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf
• https://github.com/statamic/cms/pull/14887
• https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a
• https://github.com/statamic/cms/releases/tag/v5.74.1
• https://github.com/statamic/cms/releases/tag/v6.24.0

Related advisories

• CVE-2026-54089 — critical · Go/github.com/filebrowser/filebrowser/v2
• APPSEC-NOAUTH-2023 — critical · Web app/Microsoft Entra ID (Azure AD) OAuth/OIDC apps
• CVE-2026-62367 — high · Go/code.vikunja.io/api
• CVE-2026-56675 — high · npm/9router
• CVE-2026-59224 — high · PyPI/open-webui
• CVE-2026-53817 — high · npm/openclaw
• GHSA-rggc-m335-3wvj — high · npm/openclaw
• CVE-2026-73840 — medium · Go/github.com/openchoreo/openchoreo

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity