CVE-2026-64665

Received Received - Intake

OAuth Identity Misconfiguration in Statamic CMS

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-64665

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	statamic	to 5.74.1\|end_excluding=6.24.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Statamic is a content management system that uses OAuth for login. A vulnerability exists where if OAuth is enabled with a provider that does not verify email addresses, an attacker could sign in as an existing user without knowing their password. This happens because the system matches OAuth identities to accounts solely by email address.

Detection Guidance

Check Statamic version with: composer show statamic/statamic or php artisan statamic:version. If using OAuth, verify if providers guarantee verified email addresses. Look for unauthorized logins or mismatched OAuth identities.

Impact Analysis

An attacker could gain unauthorized access to user accounts, including super admin accounts, potentially leading to data theft, unauthorized modifications, or complete system compromise. This requires OAuth to be enabled with a provider that does not verify email addresses.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Statamic to version 5.74.1 or 6.24.0 or later. Disable OAuth login if providers do not guarantee verified email addresses. Review user accounts for unauthorized access.

Hi! I’m here to help you understand CVE-2026-64665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70