CVE-2026-64665 statamic CVE debrief

Who should care

Defenders managing Statamic CMS installations, especially those using OAuth login with providers that do not enforce email verification, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-64665 allows unauthenticated attackers to sign in as existing Statamic CMS users, including super admins, via OAuth providers without email verification. Defenders should verify OAuth configurations, upgrade to fixed versions, and monitor for suspicious activity.

• Potential unauthorized access to sensitive content and administrative interfaces.
• Risk of lateral movement within the CMS and connected systems.
• Need for verification of OAuth provider configurations and user account integrity.
• Priority for upgrading to fixed versions to prevent exploitation.

Technical summary

CVE-2026-64665 is a vulnerability in Statamic CMS that allows unauthenticated attackers to sign in as existing users, including super admins, via OAuth providers that do not guarantee verified email addresses. This issue is fixed in versions 5.74.1 and 6.24.0. The vulnerability arises from the application's matching of OAuth identities to accounts by email address alone, without verifying the email address through the OAuth provider. Defenders should verify OAuth configurations, upgrade to fixed versions, and monitor for suspicious activity.

Defensive priority

Defenders should prioritize verifying OAuth provider configurations, ensuring email verification, and upgrading to fixed versions 5.74.1 or 6.24.0.

Recommended defensive actions

• Verify OAuth provider configurations to ensure email verification is enforced.
• Upgrade Statamic CMS to version 5.74.1 or 6.24.0.
• Review user accounts and OAuth connections for potential unauthorized access.
• Implement additional monitoring for suspicious login activity.
• Conduct a thorough review of existing OAuth connections and user accounts.
• Ensure that all OAuth providers used with Statamic CMS enforce email verification.
• Schedule regular security audits to detect and respond to potential vulnerabilities.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which is related to OAuth login in Statamic CMS versions before 5.74.1 and 6.24.0. The vulnerability allows unauthenticated attackers to sign in as existing users, including super admins, via OAuth providers that do not guarantee verified email addresses. Evidence is based on the CVE description and NVD assessment, with limitations on source-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.