GHSA-93qh-5269-9wcf: Statamic: Account takeover via OAuth email matching without email-verification check
Impact
When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a provider.
Patches
Fixed in 5.74.1 and 6.24.0.
Workarounds
Only enable OAuth with providers that guarantee verified email addresses, or disable OAuth login.
Details
Original advisory: https://github.com/advisories/GHSA-93qh-5269-9wcf
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-64665 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from GitHub Security Advisories
- mediumGHSA-957r-qf9p-67xw: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts2026-08-06
- mediumGHSA-6hr6-w5qg-qmwg: h2: Duplicate Host header could facilitate request smuggling2026-08-06
- mediumGHSA-596p-6jv8-775v: Craft CMS: Authenticated leak of secret environment variables2026-08-06
- mediumGHSA-rvmm-v933-jgxq: Craft CMS: Missing authorization check allows non-admin control panel users access to use…2026-08-06
- lowGHSA-7hxc-f267-h5q7: Craft CMS: Incorrect path validation could potentially lead to path traversal2026-08-06