---
id: CVE-2026-109307
title: >-
  Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting
  vulnerability in the control panel login and 2FA verification flow, where a
  user-controlled returnUrl accepting javascript: URLs is used in client-side
  navigation
summary: >-
  Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting
  vulnerability in the control panel login and 2FA verification flow, where a
  user-controlled returnUrl accepting javascript: URLs is used in client-side
  navigation. …
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:25.077'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109307'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-w5rh-mhxj-wr8r'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-dom-xss-via-returnurl-in-2fa-verification
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.196Z'
---

## Overview

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.