Authentication Bypass in Craft CMS by Pixel & Tonic

CVE-2026-112775

What is CVE-2026-112775?

Craft CMS versions 5.0.0 through 5.10.0 are susceptible to an authentication bypass flaw, where attackers can exploit the lack of invalidation for verification codes sent to users. When a user changes their email, the verification code can remain valid for active users, allowing adversaries who intercept the code to reset passwords through the users/set-password endpoint. This vulnerability poses a significant risk as it enables unauthorized account access and potential account takeovers.

References