Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T22:18:14.103Z",
  "pubdate": "2026-08-06T22:18:14.103Z",
  "executiveSummary": "An improper authentication vulnerability exists in Statamic, a Laravel and Git powered content management system, specifically within its OAuth login integration. The flaw allows unauthenticated remote attackers to execute account takeover attacks against existing users, potentially including super administrators, without requiring knowledge of the victim's password. This security deficiency arises due to the application matching incoming OAuth identities exclusively by email address without validating whether the email provider guarantees address ownership or verification.\nThe impact of successful exploitation is critical, as an attacker can compromise high-privileged accounts and achieve full administrative control over the underlying CMS installation. Exploitation capabilities are restricted to environments where OAuth login is explicitly enabled and configured with an identity provider that fails to guarantee verified email addresses. The vulnerability affects Statamic versions prior to 5.74.1 and 6.24.0. Remediation requires upgrading the affected software to version 5.74.1 or 6.24.0, where proper account matching logic and identity validation are enforced.",
  "technicalDetails": "The root cause of the vulnerability resides in the authentication logic handling external identity provider callbacks within Statamic. When OAuth authentication is enabled, the application processes the response returned by the configured third-party OAuth provider. Instead of securely mapping the external identity to an internal user account using a persistent, immutable, and cryptographically bound unique identifier (such as a provider-specific user ID or a strictly verified token claim), the application performs an insecure lookup by evaluating the email attribute supplied in the OAuth payload.\nThe vulnerable component is the authentication controller responsible for processing OAuth login flows and user reconciliation. The affected versions include all Statamic installations prior to 5.74.1 and 6.24.0. Exploitation requires no prior authentication or knowledge of valid user credentials, provided the targeted system exposes an enabled OAuth login mechanism utilizing an unverified or loosely configured email provider.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker identifies a Statamic instance with OAuth login enabled via a provider that does not enforce or guarantee email address verification. Second, the attacker registers an account or acquires control of an email address on the third-party provider that matches the target user's email address (such as a targeted super administrator). Third, the attacker initiates the OAuth authentication flow on the Statamic application and authenticates through the third-party provider using the controlled account. Fourth, the Statamic application receives the OAuth callback containing the matching email address. Fifth, the application queries its internal user database for an account sharing that exact email address. Sixth, upon finding a match, the application improperly associates the incoming session with the existing victim account, bypassing password verification entirely. Finally, the attacker is logged into the victim's account with all associated privileges, resulting in complete application compromise."
}