The vulnerability is a DOM‑based cross‑site scripting flaw in Craft CMS control panel login and two‑factor authentication (2FA) verification. A malicious URL containing a JavaScript payload can be embedded in the returnUrl parameter, and when a 2FA‑enabled user follows that link after entering their password but before confirming a TOTP code, the script executes in the context of the authenticated control panel. Because the code runs with the victim’s permissions, an attacker could deface the panel, steal session data, or inject other malicious content.

Craft CMS versions from 5.0.0 up to, but not including, 5.10.14 are affected. This includes all releases released before the 5.10.14 patch. The defect resides in the control panel login and verification flow and impacts any user who has 2FA enabled and visits a crafted /admin/login?verify=1 URL. Admin users and anyone who can convince a 2FA user to click such a link are at risk.

The CVSS score is 2.1, indicating low impact under normal circumstances, and the EPSS value is unavailable so no quantified exploit probability is reported. The flaw is listed in the CISA KEV catalog as not included. Attackers would need to persuade a logged‑in 2FA user to click a specially crafted link; they could embed the payload in email or a web page. Once the victim follows the link, the JavaScript runs with the victim’s authenticated session. The vulnerability is difficult to exploit remotely without victim interaction, but the consequence of successful exploitation is the execution of arbitrary code within the control panel.