DOM-based Cross-Site Scripting Vulnerability in Craft CMS Control Panel

CVE-2026-109307

What is CVE-2026-109307?

Craft CMS versions prior to 5.10.14 are vulnerable to a DOM-based cross-site scripting (XSS) attack through the control panel's login and two-factor authentication (2FA) verification process. A malicious actor can exploit this by tricking a 2FA-enabled user into opening a specially crafted URL during the authentication process. If a victim accesses the manipulated /admin/login?verify=1 URL between the submission of their password and the time they enter their time-based one-time password (TOTP), the attacker's JavaScript can execute with the victim's permissions in the authenticated control panel, leading to potential unauthorized actions.

References