CVE-2026-112775
CVE-2026-112775 · Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
CVSS 8.7 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
cms
- Versions
- ≥ 5.0.0, < 5.11.0: Affected (semver)
- 5.11.0: Not affected (semver)
Update to 5.11.0