https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:49:26.182852+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-72780 CVE-2026-72780 — Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey 2026-10-07T00:49:26.198544+00:00

Affected: craftcms cms

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.