high · 8.1CVE-2026-64665Aug 6, 2026

CVE-2026-64665: Statamic CMS OAuth Account Takeover via Unverified Email Matching

Rohit Hatagale
AI Security Researcher, SecureLayer7

A Statamic site using OAuth login can be broken into by anyone who registers with a third-party provider using the same email address as an existing account, letting an attacker walk in as that user…

Packagestatamic/cms
Ecosystemcomposer
Affected< 5.74.1
Fixed in5.74.1
CVE-2026-64665: Statamic CMS OAuth Account Takeover via Unverified Email Matching

The problem

Statamic's OAuth callback handler looks up an existing local user by the email address returned by the OAuth provider and logs the attacker in as that user. It never checks whether the provider has actually verified that email address.

Any provider that allows unverified email addresses, such as a self-hosted or permissive OAuth server, can be used to claim any email in the Statamic user database. Because super admins are regular users with an email address, full site takeover is possible without touching a password.

Proof of concept

A working proof-of-concept for CVE-2026-64665 in statamic/cms, with the exact payload below.

json
# Attacker controls (or uses) an OAuth provider that returns
# an unverified email matching a Statamic super admin account.
# The malicious provider's /userinfo endpoint returns:
{
  "id": "attacker-uid-999",
  "email": "superadmin@victim-site.com",
  "email_verified": false,
  "name": "Attacker"
}

# Statamic's pre-patch OAuth callback:
# 1. Receives the socialite user object above
# 2. Calls User::findByEmail('superadmin@victim-site.com')
# 3. Finds the super admin record -> logs attacker in as super admin
# No password, no token, no MFA required.

The root cause is that Statamic's OAuthController (or equivalent OAuth user-resolution logic) matches incoming OAuth users to local accounts purely by email address, with no check on whether the provider has verified ownership of that address. This is CWE-290 (Authentication Bypass by Spoofing) and CWE-287 (Improper Authentication).

The patch in commit e59dd342 (PR #14887) adds a guard that inspects the email_verified field on the Socialite user object before allowing an email-based account lookup. Providers that do not set this flag, or set it to false, are refused the match. The payload above is derived directly from this fix: the condition the patch blocks is an OAuth callback carrying a non-verified email that collides with an existing account.

The fix

Upgrade to statamic/cms 5.74.1 or 6.24.0. Both releases contain the fix from commit e59dd342. As a workaround while upgrading, disable OAuth or restrict it to providers that cryptographically guarantee verified email addresses, such as Google Workspace with domain lock or GitHub with verified primary email.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research