DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-WG23-69C2-GJC8: GHSA-WG23-69C2-GJC8: Passkey Login Replay Vulnerability in Craft CMS

#security #cve #cybersecurity #ghsa

GHSA-WG23-69C2-GJC8: Passkey Login Replay Vulnerability in Craft CMS

Vulnerability ID: GHSA-WG23-69C2-GJC8
CVSS Score: 9.1
Published: 2026-08-07

GHSA-WG23-69C2-GJC8 is a critical security vulnerability discovered in the native Passkey (WebAuthn) login implementation of Craft CMS. The vulnerability allows an attacker to bypass WebAuthn's core cryptographic challenge-response and signature-counter replay protections. By intercepting a single successful passkey login request body, an attacker can replay the identical request payload to generate additional authenticated active sessions, resulting in complete account takeover.

TL;DR

Craft CMS native Passkey authentication fails to securely validate challenge options and discard/update the signature counter, allowing complete authentication bypass via captured request replay.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-294
  • Attack Vector: Network (AV:N)
  • CVSS v4 Score: 9.1 (Critical)
  • Exploit Status: PoC / Known Mechanics
  • Impact: Authentication Bypass / Account Takeover

Affected Systems

  • Craft CMS installations utilizing native Passkey (WebAuthn) authentication
  • craftcms/cms: >= 5.0.0-RC1, < 5.10.5 (Fixed in: 5.10.5)

Code Analysis

Commit: d71a66d

Fix a vulnerability where passkey logins accept replayed WebAuthn assertions

Exploit Details

Mitigation Strategies

  • Upgrade Craft CMS to version 5.10.5 or higher
  • Disable Passkey (WebAuthn) login features if immediate patching is not possible

Remediation Steps:

  1. Navigate to the Craft CMS root directory.
  2. Execute: composer update craftcms/cms --with-dependencies
  3. Clear application caches to ensure class mapping is updated.
  4. Verify that the webauthnrecords database table records incrementing signature counters during successful passkey authentication events.

References

Read the full report for GHSA-WG23-69C2-GJC8 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)