# CVE-2026-109307: Craft CMS DOM-based cross-site scripting in 2FA verification

Source: https://junglewise.ai/threats/cve-2026-109307-craft-cms-5-0-0-before-5-10-14-contains-a-dom-based-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109307 · Severity: medium · CVSS 4.7 · Published 2026-10-12

Craft CMS is a content management system used to build and manage websites. The control panel login flow contains a cross-site scripting flaw that allows attackers to execute malicious JavaScript in an authenticated admin session. An attacker can trick a user with two-factor authentication enabled into clicking a malicious login link, and once the user completes authentication and verification, the attacker's code runs with the user's permissions, potentially allowing unauthorized changes to site content and configuration.

Technologies: [Craft CMS](https://junglewise.ai/threats/technologies/craft-cms-1). Vendors: [Craft](https://junglewise.ai/threats/vendors/craft).

## Quick answers

**Is CVE-2026-109307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109307 being exploited in the wild.

**How severe is CVE-2026-109307?** Medium severity, with a CVSS score of 4.7, published 12 October 2026.

**Which products and versions are affected?** Craft CMS 5.0.0 before 5.10.14.

**Is there a fix for CVE-2026-109307?** Yes: fixed in 5.10.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109307 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109307?** Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.10.14

## Technical details

A DOM-based XSS vulnerability exists in the login and 2FA verification flow where a user-controlled returnUrl parameter accepts javascript: URLs and is used in client-side navigation after successful authentication. Exploitation requires the victim to have 2FA enabled and to click a crafted /admin/login?verify=1 URL after submitting their password but before completing TOTP verification. The attacker-controlled JavaScript then executes in the authenticated /admin origin, enabling same-origin privileged actions such as forging authenticated API requests to modify entries, disable content, or alter site configuration.

## Affected products

- Craft CMS 5.0.0 before 5.10.14

## Timeline

- 2026-09-22: disclosed
- 2026-10-12: advisory
- 2026-10-12: patched

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-w5rh-mhxj-wr8r](https://github.com/craftcms/cms/security/advisories/GHSA-w5rh-mhxj-wr8r)
- [https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-dom-xss-via-returnurl-in-2fa-verification](https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-dom-xss-via-returnurl-in-2fa-verification)

## Related threats

- [Craft CMS SQL injection in craft.search](https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of)
- [Craft CMS authorization bypass in volume browser](https://junglewise.ai/threats/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization)
- [Craft CMS privilege escalation in public registration](https://junglewise.ai/threats/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege)
- [Craft CMS path traversal in app/icon-svg endpoint](https://junglewise.ai/threats/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file)
- [Craft CMS authorization bypass in GraphQL schema scope](https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization)