What is GHSA-jh4m-63fq-p9h9?

GHSA-jh4m-63fq-p9h9 is a security advisory published by GitHub Security Advisories with High severity. Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion...

Which CVE IDs does GHSA-jh4m-63fq-p9h9 cover?

GHSA-jh4m-63fq-p9h9 covers the following CVE IDs: CVE-2026-72780. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jh4m-63fq-p9h9?

GHSA-jh4m-63fq-p9h9 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-jh4m-63fq-p9h9HighCVSS 6.5

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion...

Vendor

GitHub Security Advisories

Published

August 11, 2026

Last Modified

August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-72780 →

📋 Description

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

🔗 References (4)

https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8
https://nvd.nist.gov/vuln/detail/CVE-2026-72780
https://www.vulncheck.com/advisories/craft-cms-before-webauthn-assertion-replay-via-login-with-passkey
https://github.com/advisories/GHSA-jh4m-63fq-p9h9