CVE-2026-112775 — Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalida…
Published: 2026-10-19 · CVSS: 8.7 · CVSS 4.0
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7