{"id":"CVE-2026-64665","title":"Statamic is a Laravel and Git powered content management system (CMS)","summary":"Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in a…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-287","CWE-290"],"vendor":"statamic","product":"statamic/cms","affected":["statamic/cms < 5.74.1","statamic/cms >= 6.0.0, < 6.24.0"],"patched":["statamic/cms 5.74.1","statamic/cms 6.24.0"],"published":"2026-08-06","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:51:43.490","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64665","references":[{"url":"https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a","label":"security-advisories@github.com"},{"url":"https://github.com/statamic/cms/pull/14887","label":"security-advisories@github.com"},{"url":"https://github.com/statamic/cms/releases/tag/v5.74.1","label":"security-advisories@github.com"},{"url":"https://github.com/statamic/cms/releases/tag/v6.24.0","label":"security-advisories@github.com"},{"url":"https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-93qh-5269-9wcf"}],"tags":["nvd","ghsa","composer"],"epss":0.00311,"epssPercentile":0.24119,"aliases":["GHSA-93qh-5269-9wcf"],"ecosystem":"composer","ingestedAt":"2026-08-06T20:03:56.658Z","slug":"CVE-2026-64665","body":"## Overview\n\nStatamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-64665)\n\nAffected packages:\n\n- `statamic/cms < 5.74.1`\n- `statamic/cms >= 6.0.0, < 6.24.0`\n\nPatched in:\n\n- `statamic/cms 5.74.1`\n- `statamic/cms 6.24.0`\n\nSource: https://github.com/advisories/GHSA-93qh-5269-9wcf","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}