CVE-2026-64665 statamic CVE debrief

Who should care

Administrators and users of Statamic with OAuth login enabled should be aware of this vulnerability and take necessary actions to protect their systems. This includes verifying OAuth configurations, updating to the latest versions, and monitoring for suspicious activity. Security teams should prioritize patching and review compensating controls for exposed systems. Additionally, operators and platform administrators should assess their exposure and implement mitigations as needed. Vulnerability management and security teams should track exceptions and retest remediated assets to ensure thorough resolution.

Technical summary

CVE-2026-64665 is a vulnerability in Statamic, a Laravel and Git powered content management system (CMS). When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password. The issue arises from the application's reliance on email address matching for OAuth identities. Exploitation requires OAuth to be explicitly enabled with such a provider. The vulnerability is fixed in versions 5.74.1 and 6.24.0, which enhance the email verification process for OAuth logins.

Defensive priority

Organizations using Statamic with OAuth login enabled should verify their configurations and update to versions 5.74.1 or 6.24.0.

Recommended defensive actions

• Verify OAuth login configurations in Statamic
• Update Statamic to version 5.74.1 or 6.24.0
• Monitor for suspicious login activity
• Review system logs for unusual activity
• Confirm user account integrity
• Assess exposure and implement mitigations as needed
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD detail provide information on the vulnerability in Statamic. The vulnerability allows an unauthenticated attacker to sign in as an existing user without knowing the user's password when OAuth login is enabled with a provider that does not guarantee verified email addresses. To verify, defenders should review OAuth configurations, check for suspicious login activity, and ensure updates are applied. Additional verification steps include reviewing system logs, monitoring for unusual activity, and confirming user account integrity.

Official resources