https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:34:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349683 EUVD-2026-349683 https://cve.radiocsirt.org/vuln/euvd-2026-349683 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71293 <p>Statamic CMS&#39;s user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user&#39;s raw two-factor recovery codes with no access restriction.</p> <p>Statamic CMS&#39;s user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user&#39;s raw two-factor recovery codes with no access restriction.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71293 https://cve.radiocsirt.org/vuln/ghsa-jppw-r5j3-xf7x <p><strong>Affected:</strong> Packagist: statamic/cms</p> <p>Statamic CMS&#39;s user-augmentation resolver, AugmentedUser::get() in src/Auth/AugmentedUser.php, contains an explicit case for the `two_factor_recovery_codes` handle that returns the user&#39;s raw two-factor recovery codes with no access restriction: `if ($handle === &#39;two_factor_recovery_codes&#39;) { return new Value($this-&gt;data-&gt;get(&#39;two_factor_recovery_codes&#39;), ...); }`. Unlike sensitive fields such as password/password_hash, which are excluded from AugmentedUser entirely, two_factor_recovery_codes is neither excluded from augmentation nor present in Statamic&#39;s Antlers variable guard lists (guardedVariablePatterns/guardedContentVariablePatterns in src/Providers/ViewServiceProvider.php, and the runtime GlobalRuntimeState guard paths), which by default only guard config.app.key. On any Antlers template field where raw/dynamic template rendering is enabled for a given field (an admin/developer-configured, blueprint-level field option), a template such as `{{ current_user.two_factor_recovery_codes }}{{ value }}|{{ /current_user.two_factor_recovery_codes }}` renders the viewing user&#39;s own 2FA recovery codes directly into the HTML response, allowing an attacker who can view or capture that response (e.g. via a shared/observable page, or a crafted link causing a victim to render it) to obtain the codes and bypass 2FA. Exploitation requires that dynamic Antlers rendering already be enabled on a field the target user&#39;s data flows through, which is a blueprint-configuration privilege rather…</p> <p><strong>Affected:</strong> Packagist: statamic/cms</p> <p>Statamic CMS&#39;s user-augmentation resolver, AugmentedUser::get() in src/Auth/AugmentedUser.php, contains an explicit case for the `two_factor_recovery_codes` handle that returns the user&#39;s raw two-factor recovery codes with no access restriction: `if ($handle === &#39;two_factor_recovery_codes&#39;) { return new Value($this-&gt;data-&gt;get(&#39;two_factor_recovery_codes&#39;), ...); }`. Unlike sensitive fields such as password/password_hash, which are excluded from AugmentedUser entirely, two_factor_recovery_codes is neither excluded from augmentation nor present in Statamic&#39;s Antlers variable guard lists (guardedVariablePatterns/guardedContentVariablePatterns in src/Providers/ViewServiceProvider.php, and the runtime GlobalRuntimeState guard paths), which by default only guard config.app.key. On any Antlers template field where raw/dynamic template rendering is enabled for a given field (an admin/developer-configured, blueprint-level field option), a template such as `{{ current_user.two_factor_recovery_codes }}{{ value }}|{{ /current_user.two_factor_recovery_codes }}` renders the viewing user&#39;s own 2FA recovery codes directly into the HTML response, allowing an attacker who can view or capture that response (e.g. via a shared/observable page, or a crafted link causing a victim to render it) to obtain the codes and bypass 2FA. Exploitation requires that dynamic Antlers rendering already be enabled on a field the target user&#39;s data flows through, which is a blueprint-configuration privilege rather…</p> https://cve.radiocsirt.org/vuln/ghsa-jppw-r5j3-xf7x