Craft CMS: Authentication bypass via reuse of verification codes
Summary
Craft CMS versions 5.0.0 up to 5.11.0 (excluding 5.11.0) do not invalidate an email verification code after it is used on users/verify-email for active users. An attacker who already holds a victim's emailed code can reuse it on users/set-password after the victim verifies an email change, reset the password and take over the account. The attacker must obtain the code first, for example from a shared mailbox or logs, so the attack is targeted rather than mass exploitation.
Affected
- Craft CMS 5.0.0 up to but not including 5.11.0
Fixed in
- Craft CMS 5.11.0 and later
Workaround
- No vendor workaround known. Upgrading to 5.11.0 is the documented fix.
- Interim measures (not from the vendor): restrict control panel and user-account endpoints to trusted networks where possible.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- No public proof of concept found in the sources reviewed.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
Our recommendation
- Check which Craft CMS installations run 5.x and whether they are older than 5.11.0.
- Upgrade affected installations to 5.11.0 or later, which also contains other Craft fixes.
- Review recent verify-email and password-reset activity in logs and check user accounts for unexpected email or password changes.
- Prioritise sites that accept user registrations or email changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xh42-494x-2xgv github.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE CVE-2026-112775 app.opencve.io
- Strix CVE-2026-112775 www.strix.ai
- Italian CSIRT (ACN) alert on Craft CMS www.acn.gov.it
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:02.
Original description (NVD)
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.