https://vulnerability.circl.lu/sightings/feed 2026-09-06T16:45:44.674101+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/138a60f7-51ed-4421-8ffc-c61233e9d71c/export 2026-09-06T16:45:44.684033+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "138a60f7-51ed-4421-8ffc-c61233e9d71c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-wg23-69c2-gjc8", "type": "seen", "source": "https://gist.github.com/alon710/1c07f05a9611684f7f4ae2d0d6c93c3e", "content": "# GHSA-WG23-69C2-GJC8: GHSA-WG23-69C2-GJC8: Passkey Login Replay Vulnerability in Craft CMS\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/GHSA-WG23-69C2-GJC8\n\n## Summary\nGHSA-WG23-69C2-GJC8 is a critical security vulnerability discovered in the native Passkey (WebAuthn) login implementation of Craft CMS. The vulnerability allows an attacker to bypass WebAuthn's core cryptographic challenge-response and signature-counter replay protections. By intercepting a single successful passkey login request body, an attacker can replay the identical request payload to generate additional authenticated active sessions, resulting in complete account takeover.\n\n## TL;DR\nCraft CMS native Passkey authentication fails to securely validate challenge options and discard/update the signature counter, allowing complete authentication bypass via captured request replay.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-294\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4 Score**: 9.1 (Critical)\n- **Exploit Status**: PoC / Known Mechanics\n- **Impact**: Authentication Bypass / Account Takeover\n\n## Affected Systems\n\n- Craft CMS installations utilizing native Passkey (WebAuthn) authentication\n- **craftcms/cms**: >= 5.0.0-RC1, < 5.10.5 (Fixed in: `5.10.5`)\n\n## Mitigation\n\n- Upgrade Craft CMS to version 5.10.5 or higher\n- Disable Passkey (WebAuthn) login features if immediate patching is not possible\n\n**Remediation Steps:**\n1. Navigate to the Craft CMS root directory.\n2. Execute: composer update craftcms/cms --with-dependencies\n3. Clear application caches to ensure class mapping is updated.\n4. Verify that the webauthnrecords database table records incrementing signature counters during successful passkey authentication events.\n\n## References\n\n- [GHSA-WG23-69C2-GJC8: Craft CMS Passkey Login Replay Vulnerability](https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8)\n- [Craft CMS Fix Commit](https://github.com/craftcms/cms/commit/d71a66d69cf8852bcfca4484ca718750b5a316d6)\n- [Craft CMS Release 5.10.5](https://github.com/craftcms/cms/releases/tag/5.10.5)\n- [Craft CMS Repository](https://github.com/craftcms/cms)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-WG23-69C2-GJC8) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T15:31:58.269797Z"} 2026-08-07T15:31:58.269797+00:00