CVE-2026-71293

Received Received - Intake

Two-Factor Recovery Codes Exposure in Statamic CMS

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-16

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-15

NVD

CVE-2026-71293

EUVD

EUVD-2026-53378

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	statamic	*
statamic	cms	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Statamic CMS allows exposure of a user's two-factor authentication recovery codes through improper handling in the AugmentedUser class. The system returns raw recovery codes without access restrictions when requested via a specific handle, unlike other sensitive fields like passwords.

Detection Guidance

Check if dynamic Antlers rendering is enabled on fields that may expose user data. Inspect templates for patterns like {{ current_user.two_factor_recovery_codes }}. Review blueprint configurations for fields with raw/dynamic rendering options.

Impact Analysis

An attacker could obtain a user's two-factor recovery codes by exploiting dynamic Antlers template rendering. This would allow bypassing two-factor authentication if they gain access to the recovery codes, potentially leading to unauthorized account access.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and privacy such as GDPR or HIPAA by exposing sensitive authentication recovery codes. It undermines security controls designed to protect user accounts and sensitive data.

Mitigation Strategies

Disable dynamic Antlers rendering for fields handling sensitive data. Exclude two_factor_recovery_codes from AugmentedUser by updating src/Auth/AugmentedUser.php. Add two_factor_recovery_codes to guardedVariablePatterns in src/Providers/ViewServiceProvider.php.

Hi! I’m here to help you understand CVE-2026-71293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70