User Authentication Vulnerability in Statamic CMS by Statamic

CVE-2026-71293

What is CVE-2026-71293?

Statamic CMS includes a flaw within its user-augmentation resolver that permits the retrieval of raw two-factor authentication recovery codes without proper access restrictions. Specifically, the AugmentedUser::get() method returns these codes directly if a specific handle is called, exposing them in HTML responses when dynamic rendering is enabled. This can allow malicious users to capture codes via shared pages or through crafted links, facilitating a circumvention of two-factor authentication protections. Proper configuration and security measures should be implemented to mitigate potential exploitation of this vulnerability.

References