CVE-2026-71293: Statamic CMS two-factor recovery code exposure in Antlers templates

CVE-2026-71293 · Severity: medium · CVSS 6.2 · Published 2026-08-05

Statamic CMS is a Laravel-based content management system. An unprotected code path in its user data handler allows two-factor authentication recovery codes to be rendered into HTML responses when dynamic template processing is enabled on certain content fields, letting attackers who can view or control the rendered output capture 2FA recovery codes and bypass multi-factor authentication.

Technologies: statamic/cms (Packagist), Statamic. Vendors: Packagist, Statamic.

Quick answers

Is CVE-2026-71293 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71293 being exploited in the wild.
How severe is CVE-2026-71293?
Medium severity, with a CVSS score of 6.2, published 5 August 2026.
Which products and versions are affected?
statamic/cms (Packagist) >= 6.0.0-alpha.1, <= 6.30.0, ECOSYSTEM:introduced=6.0.0-alpha.1,last_affected=6.30.0; Statamic 6.0.0-alpha.1 through 6.30.0.
Is there a fix for CVE-2026-71293?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-71293 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-71293?
Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in AugmentedUser::get() in src/Auth/AugmentedUser.php, which explicitly returns the raw two_factor_recovery_codes field without any access restrictions. Unlike sensitive fields such as password/password_hash which are entirely excluded from the augmentation layer, two_factor_recovery_codes is neither excluded from augmentation nor protected by Statamic's Antlers variable guard lists. When dynamic template rendering is enabled at the blueprint field level, an attacker can inject a template like `{{ current_user.two_factor_recovery_codes }}{{ value }}|{{ /current_user.two_factor_recovery_codes }}` which renders the user's 2FA recovery codes directly into the HTML response. The attacker must have either blueprint-configuration privilege (to enable dynamic rendering on a field) or the ability to view or capture the HTML output of such a page. Exploitation allows bypassing two-factor authentication for affected users. No patch has been released as of the advisory publication date.

Affected products

  • Statamic CMS 6.0.0-alpha.1 through 6.30.0

Identifiers

  • CVE-2026-71293
  • GHSA-jppw-r5j3-xf7x

Timeline

  • 2026-08-05: disclosed: Published to GitHub Advisory Database
  • 2026-09-01: advisory: Reviewed and finalized

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.