CVE-2026-112775: Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Craft CMS versions from 5.0.0 up to, but not including, 5.11.0 are affected. The issue concerns the verification-code handling used by the users/verify-email and users/set-password endpoints.
What does an attacker need to take over an account?
The attacker must obtain a victim's emailed verification code. After the victim verifies an email change, the attacker can reuse that code with users/set-password to reset the victim's password.
What is the impact of successful exploitation?
A successful attacker can reset the victim's password and take over the account. The provided severity vector indicates no privileges or user interaction are required once the attacker has the verification code.