Craft CMS Authentication Bypass Allows Account Takeover via Code Reuse

Craft CMS contains a high-severity authentication bypass flaw that enables attackers to hijack user accounts by reusing email verification codes. According to the National Vulnerability Database, this issue affects all versions of the content management system from 5.0.0 up to, but not including, 5.11.0. The vulnerability stems from how the platform handles email verification requests for active users, creating a window where codes remain valid even after they have been used.

The risk

The specific weakness is classified as CWE-287, indicating an improper authorization mechanism. In this scenario, an attacker who obtains a victim's emailed verification code can submit it to the password reset endpoint. This action succeeds even after the victim has already verified an email change, effectively bypassing standard authentication checks. The result is a forced password reset that grants the attacker full access to the targeted account.

Who is exposed

Any organization running Craft CMS versions earlier than 5.11.0 is exposed to this risk. The vulnerability specifically targets the user management functionality, meaning administrators and regular users alike are at risk if their verification codes are intercepted. Environments where email traffic can be monitored or manipulated by threat actors face the highest likelihood of exploitation, as the attack vector relies on obtaining the one-time code sent via email.

Cost and compliance

The National Vulnerability Database rates this vulnerability with a CVSS score of 8.7, placing it in the high severity category. This rating reflects the significant impact of unauthorized account access and the ease with which the flaw can be leveraged. There is no information in the source material regarding confirmed widespread exploitation or specific financial damages incurred by organizations. The source material indicates that versions before 5.11.0 are affected, implying that 5.11.0 resolves the issue.

What to watch

Security teams should immediately inventory their Craft CMS installations to identify any systems running versions prior to 5.11.0. Monitoring for unusual password reset activity, particularly from new IP addresses or geographic locations, is essential. Organizations should also review email logs for signs of interception or forwarding rules that could expose verification codes to unauthorized parties.

Signals worth monitoring

Teams usually detect this type of activity by correlating email delivery logs with authentication events. Check whether verification codes are being submitted to password reset endpoints after the associated email change has already been confirmed. Look for multiple password reset attempts from different sources using the same code. Containment moves typically involve forcing a logout for all sessions of the compromised account and revoking active tokens. Reviewing server access logs for requests to the users/set-password endpoint can also reveal the initial compromise attempt.

Background: Authentication bypass vulnerabilities

Authentication bypass vulnerabilities arise from logic flaws, improper session handling, and misconfigured permissions. These mistakes let attackers access data without valid credentials. Fixing them requires strict input validation, secure session management, and regular vulnerability scanning to identify weak points before exploitation.

Read the full guide: Authentication Bypass Mistakes That Leave Systems Exposed

What to do and how to stay safe: Craft CMS

• Audit all Craft CMS installations to ensure they are updated to version 5.11.0 or later.
• Monitor authentication logs for password reset requests that occur shortly after email verification events.
• Implement additional verification steps for password changes, such as requiring the current password or multi-factor authentication.
• Review email server configurations to prevent unauthorized forwarding or interception of verification messages.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Craft CMS are affected by this vulnerability?

Craft CMS versions from 5.0.0 before 5.11.0 are affected by this authentication bypass flaw.

How do attackers exploit this vulnerability?

Attackers exploit this by obtaining a victim's email verification code and submitting it to the password reset endpoint to take over the account.

What is the severity rating for this CVE?

The National Vulnerability Database rates CVE-2026-112775 as high severity with a CVSS score of 8.7.