CVE-2026-71293
Received Received - Intake

Two-Factor Recovery Codes Exposure in Statamic CMS

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Statamic CMS's user-augmentation resolver, AugmentedUser::get() in src/Auth/AugmentedUser.php, contains an explicit case for the `two_factor_recovery_codes` handle that returns the user's raw two-factor recovery codes with no access restriction: `if ($handle === 'two_factor_recovery_codes') { return new Value($this->data->get('two_factor_recovery_codes'), ...); }`. Unlike sensitive fields such as password/password_hash, which are excluded from AugmentedUser entirely, two_factor_recovery_codes is neither excluded from augmentation nor present in Statamic's Antlers variable guard lists (guardedVariablePatterns/guardedContentVariablePatterns in src/Providers/ViewServiceProvider.php, and the runtime GlobalRuntimeState guard paths), which by default only guard config.app.key. On any Antlers template field where raw/dynamic template rendering is enabled for a given field (an admin/developer-configured, blueprint-level field option), a template such as `{{ current_user.two_factor_recovery_codes }}{{ value }}|{{ /current_user.two_factor_recovery_codes }}` renders the viewing user's own 2FA recovery codes directly into the HTML response, allowing an attacker who can view or capture that response (e.g. via a shared/observable page, or a crafted link causing a victim to render it) to obtain the codes and bypass 2FA. Exploitation requires that dynamic Antlers rendering already be enabled on a field the target user's data flows through, which is a blueprint-configuration privilege rather than a standard content-editing permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71293
EUVD
EUVD-2026-53378

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
statamic statamic *
statamic cms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Statamic CMS allows exposure of a user's two-factor authentication recovery codes through improper handling in the AugmentedUser class. The system returns raw recovery codes without access restrictions when requested via a specific handle, unlike other sensitive fields like passwords.

Detection Guidance

Check if dynamic Antlers rendering is enabled on fields that may expose user data. Inspect templates for patterns like {{ current_user.two_factor_recovery_codes }}. Review blueprint configurations for fields with raw/dynamic rendering options.

Impact Analysis

An attacker could obtain a user's two-factor recovery codes by exploiting dynamic Antlers template rendering. This would allow bypassing two-factor authentication if they gain access to the recovery codes, potentially leading to unauthorized account access.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and privacy such as GDPR or HIPAA by exposing sensitive authentication recovery codes. It undermines security controls designed to protect user accounts and sensitive data.

Mitigation Strategies

Disable dynamic Antlers rendering for fields handling sensitive data. Exclude two_factor_recovery_codes from AugmentedUser by updating src/Auth/AugmentedUser.php. Add two_factor_recovery_codes to guardedVariablePatterns in src/Providers/ViewServiceProvider.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart