CVE-2026-64665

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.

• CWE-287
• CWE-290

• https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a
• https://github.com/statamic/cms/pull/14887
• https://github.com/statamic/cms/releases/tag/v5.74.1
• https://github.com/statamic/cms/releases/tag/v6.24.0
• https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf

Published

Aug 6, 2026

Last Modified

Aug 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64653GitHub CLI (gh) is GitHub’s official command line tool. Prio…5.1
• CVE-2026-64654GitHub CLI (gh) is GitHub's official command line tool. Prio…5.3
• CVE-2026-64655GitHub CLI (gh) is GitHub’s official command line tool. Prio…2.1
• CVE-2026-64662Statamic is a Laravel and Git powered content management sys…6.5
• CVE-2026-64663Statamic is a Laravel and Git powered content management sys…6.5
• CVE-2026-64664Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-64676Kata Containers is an open source implementation of lightwei…5.7
• CVE-2026-64677Anki is a program for creating and reviewing flashcards. Pri…5.9
• CVE-2026-64685ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-64691A buffer overflow was addressed with improved size validatio…9.8
• CVE-2026-64692An out-of-bounds read was addressed with improved bounds che…7.1
• CVE-2026-64693A type confusion issue was addressed with improved checks. T…5.5