Statamic CMS allows an unauthenticated user to log in as an existing account if OAuth is enabled with a provider that does not guarantee verified email addresses; the system matches identities solely on email address. This flaw provides an attacker the ability to access any account, including super administrators, without knowing the account password. The weakness lies in authentication bypass and improper credential matching, as classified by CWE‑287 and CWE‑290.

The vulnerability affects the Statamic content management system. Versions prior to 5.74.1 and prior to 6.24.0 are impacted when OAuth login is enabled with a provider that does not supply verified email addresses. All users, including super administrators, are potentially at risk if the OAuth integration is active.

The CVSS score of 8.1 indicates high severity, and the EPSS score is not available, while the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an unauthenticated OAuth request to the site that maps the provider’s email address to an existing Statamic account. Exploitation requires the attacker to have access to an OAuth provider lacking email verification, but no special internal privileges are needed, making the flaw broadly exploitable.