Authentication Bypass Vulnerability via Capture and Replay in Craft CMS
On August 10, 2026, INCIBE-CERT published a notice about a critical vulnerability in Craft CMS affecting versions from 5.0.0-RC1 up to, but not including, 5.10.5. This vulnerability corresponds to an authentication bypass in Craft CMS that allows the reuse of login requests with passkeys through capture and replay attacks.
How the Craft CMS Authentication Bypass Works
Craft CMS accepts the PublicKeyCredentialRequestOptions request options at the users/login-with-passkey endpoint from an unauthenticated request body. However, it does not update or persist the credential counter returned by the WebAuthn assertion validator after validation.
This means that the body of a login request with a valid passkey can be captured and reused. If an attacker resends these request options, validation occurs with an outdated credential counter, allowing the creation of additional authenticated sessions for the affected user without any new interaction or credentials.
Impact on Craft CMS Security
This vulnerability turns passkey authentication into a process vulnerable to replay attacks. Access keys, which should be unique and verified by the server, become bearer artifacts that can be reused multiple times if the body of a successful assertion is exposed.
INCIBE-CERT classifies this Craft CMS authentication bypass as critical, as it enables the creation of unauthorized sessions without the system detecting the reuse of previously captured legitimate requests.
Measures to Mitigate the Vulnerability
The official proposed solution is to update Craft CMS to version 5.10.5 or higher, where the issue with credential counter handling is fixed. This update prevents authentication requests from being reused to create additional sessions.
INCIBE-CERT notes that the vulnerability does not have an assigned CVE identifier as of now, but emphasizes the importance of applying the update to prevent unauthorized access resulting from this Craft CMS authentication bypass.
Relevance and Follow-Up
This vulnerability falls within known challenges in the implementation of WebAuthn and passwordless authentication, where proper handling of counters and session data is crucial to avoid replay attacks.
The INCIBE-CERT notice is the primary source documenting this vulnerability, aimed specifically at system administrators using affected versions of Craft CMS. The alert highlights the need to review and update installations to prevent risks arising from the authentication bypass via capture and replay in Craft CMS.
For detailed information, the official notice can be consulted at the original source.
Published: 12/08/2026. Content reviewed using experience, authority and trustworthiness criteria (E-E-A-T).
This article may have used artificial intelligence tools to support structure, editing, translation or review. Editorial responsibility and final review remain with Toni Berraquero. View AI policy
You can support the project or share this article in one click. At least this block does something useful.