What is CVE-2026-72780?

CVE-2026-72780 is a medium-severity vulnerability in Craftcms Cms, classified under Authentication Bypass by Capture-replay. CVSS score: 6.5/10. Published 2026-08-11.

How severe is CVE-2026-72780?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Craftcms Cms

CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create add…

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Craftcms Cms — versions 5.0.0-RC1, 5.10.5

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-72780?: CVE-2026-72780 is a medium-severity vulnerability in Craftcms Cms, classified under Authentication Bypass by Capture-replay. CVSS score: 6.5/10. Published 2026-08-11.
How severe is CVE-2026-72780?: Medium severity. CVSS v3 base score is 6.5 out of 10.