Craft CMS versions 5.0.0 through 5.10.x contain a flaw that allows an attacker to reuse a verification code after a victim has confirmed an email change. By submitting that code to the users/set-password endpoint, the attacker can reset the victim’s password and assume control of the account. The vulnerability is an authentication bypass based on code reuse and results in a full account takeover, compromising confidentiality, integrity, and availability of the affected user data.

The affected product is Craft CMS developed by Craft CMS Inc. Versions 5.0.0 up to (but not including) 5.11.0 are vulnerable. Users operating these releases with the default public API endpoints are at risk.

The CVSS score of 8.7 indicates a high severity, and the lack of an EPSS score or KEV listing suggests the exploitation likelihood is currently undocumented but non-zero. The vulnerability can be leveraged remotely by sending crafted HTTP requests to the exposed users/set-password API after an attacker obtains a victim’s emailed code. The attack vector is inferred to be remote web access, as the flaw revolves around publicly available endpoints and does not require local system access.