Vulnerability Database

374,644

Total vulnerabilities in the database

Craft CMS: Passkey login accepts replayed WebAuthn assertions — craftcms / cms

Authentication Bypass by Capture-replay

Craft CMS passkey login accepts WebAuthn requestOptions from the unauthenticated login request body and does not persist the updated credential counter returned by the WebAuthn assertion validator. A captured passkey login request body can therefore be replayed because the old challenge is accepted again, and the stored credential counter remains stale.

Craft CMS 5.10.3 and current 5.x HEAD accept PublicKeyCredentialRequestOptions from the unauthenticated users/login-with-passkey request body and do not persist the updated PublicKeyCredentialSource returned/mutated by web-auth/webauthn-lib after assertion validation.

As a result, a captured passkey login request body is not one-time-use. Reposting the same requestOptions and response can result in validation against the same stale credential counter and create another Craft session for that user. This weakens passkeys from a fresh, server-challenged authentication ceremony into a replayable bearer artifact if one successful assertion body is exposed.

Attack Scenario

  1. A victim successfully logs in with a passkey.
  2. The POST /actions/users/login-with-passkey body containing requestOptions and response is captured from an application/request log, debugging proxy, browser extension, compromised analytics layer, or another request-body disclosure point.
  3. The attacker reposts the same body to users/login-with-passkey.
  4. Craft deserializes the attacker-supplied requestOptions, so the old challenge remains accepted for validation.
  5. The WebAuthn validator compares the assertion's signCount against the stale stored credential counter.
  6. Because Craft did not persist the updated credential source on the original login, the same stale stored counter is used again.
  7. The same captured assertion validates and Craft creates another authenticated session for the victim account.

This is exactly what WebAuthn's challenge and signature-counter lifecycle is meant to prevent: a successful assertion should be bound to a server-issued challenge and should update server-side credential state so it cannot be used again.

Impact

An attacker who obtains one successful passkey login request body can replay it to create additional authenticated Craft sessions for that user. This defeats WebAuthn’s intended one-time challenge and signature-counter replay protection, reducing a passkey assertion to a reusable bearer artifact if exposed through request logging, a debugging proxy, a compromised same-origin script layer, or another request-body disclosure path.

The impact is an account/session takeover of the affected passkey account after a single assertion body is captured. The issue is in Craft’s native passkey login flow and affects fresh Craft installations with passkeys enabled.

  • Published: Aug 7, 2026
  • Updated: Aug 8, 2026
  • GHSA: GHSA-wg23-69c2-gjc8
  • Severity: Critical
  • Exploit:
  • CISA KEV:

No technical information available.

CWEs:

Software From Fixed in
Composer icon craftcms / cms 5.0.0-RC1 5.10.5

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.