Executive brief
Statamic CMS is a Laravel-based content management system. An unprotected code path in its user data handler allows two-factor authentication recovery codes to be rendered into HTML responses when dynamic template processing is enabled on certain content fields, letting attackers who can view or control the rendered output capture 2FA recovery codes and bypass multi-factor authentication.
Technical details
The vulnerability exists in AugmentedUser::get() in src/Auth/AugmentedUser.php, which explicitly returns the raw two_factor_recovery_codes field without any access restrictions. Unlike sensitive fields such as password/password_hash which are entirely excluded from the augmentation layer, two_factor_recovery_codes is neither excluded from augmentation nor protected by Statamic's Antlers variable guard lists. When dynamic template rendering is enabled at the blueprint field level, an attacker can inject a template like `{{ current_user.two_factor_recovery_codes }}{{ value }}|{{ /current_user.two_factor_recovery_codes }}` which renders the user's 2FA recovery codes directly into the HTML response. The attacker must have either blueprint-configuration privilege (to enable dynamic rendering on a field) or the ability to view or capture the HTML output of such a page. Exploitation allows bypassing two-factor authentication for affected users. No patch has been released as of the advisory publication date.
Affected products
- Statamic CMS 6.0.0-alpha.1 through 6.30.0
Timeline
- 2026-08-05: disclosed: Published to GitHub Advisory Database
- 2026-09-01: advisory: Reviewed and finalized