VDB
KO
HIGH 8.1

GHSA-93qh-5269-9wcf

Statamic: Account takeover via OAuth email matching without email-verification check

Quick fix

GHSA-93qh-5269-9wcf — statamic/cms: upgrade to the fixed version with the command below. 

composer require statamic/cms:^5.74.1

Details

### Impact

When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a provider.

### Patches

Fixed in 5.74.1 and 6.24.0.

### Workarounds

Only enable OAuth with providers that guarantee verified email addresses, or disable OAuth login.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist / statamic/cms
Introduced in: 0 Fixed in: 5.74.1
Fix composer require statamic/cms:^5.74.1
Packagist / statamic/cms
Introduced in: 6.0.0 Fixed in: 6.24.0
Fix composer require statamic/cms:^6.24.0

References