CVE-2026-72780 — Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login reque…
Published: 2026-08-11 · CVSS: 7.1 · CVSS 4.0
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7