Executive brief
Craft CMS, a popular content management system, contains a vulnerability in its passkey login system. The software fails to properly invalidate authentication challenges and does not update internal security counters after a user logs in. This allows an attacker who intercepts a single successful login request to reuse that data to gain full access to the victim's account without needing their physical passkey.
Technical details
A capture-replay vulnerability (CWE-294) exists in Craft CMS's WebAuthn implementation. The application accepts 'PublicKeyCredentialRequestOptions' directly from the unauthenticated 'users/login-with-passkey' request body rather than enforcing server-side session-bound challenges. Additionally, the system fails to persist the updated 'PublicKeyCredentialSource' (specifically the signCount) returned by the validator. An attacker who captures a valid login request can replay the same challenge and assertion to generate new authenticated sessions, as the server will validate the signature against a stale, non-incremented counter. This has been patched in version 5.10.5.
Affected products
- Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.10.5
Timeline
- 2026-07-25: disclosed: Initial advisory publication
- 2026-08-07: advisory: GitHub Advisory reviewed and updated
- 2026-06-02: patched: Release of version 5.10.5