CVE-2026-64665
Statamic: Account takeover via OAuth email matching without email-verification check
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.
| CWE | CWE-287 CWE-290 |
| Vendor | statamic |
| Product | cms |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for statamic cms
Be the first to know when new high vulnerabilities affecting statamic cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
statamic / cms
< 5.74.1 >= 6.0.0, < 6.24.0
References
github.com: https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf github.com: https://github.com/statamic/cms/pull/14887 github.com: https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a github.com: https://github.com/statamic/cms/releases/tag/v5.74.1 github.com: https://github.com/statamic/cms/releases/tag/v6.24.0