CVE-2026-72780 craftcms CVE debrief

Who should care

Organizations using Craft CMS, especially those with high security requirements, should be aware of this vulnerability and take steps to mitigate it. This includes verifying their Craft CMS version, applying updates if necessary, reviewing login endpoint security and WebAuthn assertion validation, and monitoring for suspicious login activity. Implementing additional authentication measures can also help prevent potential authenticated session creation through replayed login requests. Security teams and vulnerability management teams should prioritize this vulnerability and plan for remediation accordingly. Additionally, operators and platform administrators should be aware of the potential impact on their systems and take necessary precautions to prevent exploitation. Affected teams should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated assets to ensure the vulnerability is properly addressed. This vulnerability may impact various stakeholders, including developers, system administrators, and security professionals responsible for maintaining and securing Craft CMS deployments. They should assess their exposure, review vendor guidance, and apply necessary updates or mitigations to prevent exploitation. Furthermore, organizations should consider the potential operational impact of this vulnerability and plan accordingly to minimize potential disruptions. By taking proactive steps, organizations can reduce the risk associated with this vulnerability and protect their systems from potential attacks. The vulnerability's impact on an organization's security posture should be carefully evaluated, and necessary measures should be taken to prevent exploitation and minimize potential damage. This may involve coordinating with vendors, reviewing system configurations, and implementing additional security controls to prevent unauthorized access. Overall, a comprehensive approach to addressing this vulnerability is essential to ensure the security and integrity of affected systems. To further mitigate the risk, organizations should also consider implementing monitoring and logging,

Technical summary

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. This allows attackers to replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts. The vulnerability impacts organizations using Craft CMS, especially those with high security requirements. Official records from CVE Program and NVD provide details on the vulnerability.

Defensive priority

Organizations using Craft CMS should verify their version and apply updates to prevent potential authenticated session creation through replayed login requests.

Recommended defensive actions

• Verify Craft CMS version and apply updates if necessary
• Review login endpoint security and WebAuthn assertion validation
• Monitor for suspicious login activity and implement additional authentication measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint, allowing attackers to replay captured login request bodies to create additional authenticated sessions for victim accounts. Official records from CVE Program and NVD provide details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.