Summary
Craft CMS contains an authentication bypass flaw in its email verification workflow because verification codes may remain usable after an active user verifies an email change. If an attacker obtains a victim's emailed verification code, they may reuse it to set a new password and take over the account.
Craft CMS contains an authentication bypass flaw in its email verification workflow because verification codes may remain usable after an active user verifies an email change. If an attacker obtains a victim's emailed verification code, they may reuse it to set a new password and take over the account.
Affected context
The issue affects Craft CMS installations using the affected email-change and password-reset workflow. It becomes risky when a verification code remains valid after the victim completes email verification and an attacker can obtain or submit that code to the password-setting endpoint.
The issue affects Craft CMS installations using the affected email-change and password-reset workflow. It becomes risky when a verification code remains valid after the victim completes email verification and an attacker can obtain or submit that code to the password-setting endpoint.
Exploit preconditions
- Attack surface: Email verification and password-setting web endpoints
- Required access: Possession of a victim's valid emailed verification code
- Trigger point: Submission of the code to the password-setting workflow after email verification
- Why exploitation is possible: Verification codes for active users are not invalidated after successful verification, allowing reuse within the workflow
- Attack surface: Email verification and password-setting web endpoints
- Required access: Possession of a victim's valid emailed verification code
- Trigger point: Submission of the code to the password-setting workflow after email verification
- Why exploitation is possible: Verification codes for active users are not invalidated after successful verification, allowing reuse within the workflow
Why this happens
The underlying flaw is an authentication-state and token-lifecycle failure. The application accepts a verification code without reliably invalidating it after the associated active user completes email verification. This allows a previously issued authentication artifact to remain usable for a sensitive password change, mapping to CWE-287: Improper Authentication.
The underlying flaw is an authentication-state and token-lifecycle failure. The application accepts a verification code without reliably invalidating it after the associated active user completes email verification. This allows a previously issued authentication artifact to remain usable for a sensitive password change, mapping to CWE-287: Improper Authentication.
Potential impact
- An attacker may reset a victim's password
- An attacker could take over an affected user account
- Account data and administrative capabilities may be exposed
- An attacker may use the compromised account for further unauthorized actions
- An attacker may reset a victim's password
- An attacker could take over an affected user account
- Account data and administrative capabilities may be exposed
- An attacker may use the compromised account for further unauthorized actions
General mitigation guidance
Mitigation generally focuses on enforcing strict verification-code lifecycle controls and binding sensitive actions to the correct authenticated state.
Common defensive patterns include:
- Invalidate verification codes immediately after successful use or completion of the related verification step
- Bind codes to the intended user, purpose, session, and expected workflow state
- Require fresh authentication or additional verification before password changes
- Prevent previously issued codes from being reused across endpoint transitions
- Apply least privilege and strong session protections to limit the effect of account compromise
- Provide secure account-recovery and notification controls for password changes
Mitigation generally focuses on enforcing strict verification-code lifecycle controls and binding sensitive actions to the correct authenticated state.
Common defensive patterns include:
- Invalidate verification codes immediately after successful use or completion of the related verification step
- Bind codes to the intended user, purpose, session, and expected workflow state
- Require fresh authentication or additional verification before password changes
- Prevent previously issued codes from being reused across endpoint transitions
- Apply least privilege and strong session protections to limit the effect of account compromise
- Provide secure account-recovery and notification controls for password changes
How teams detect issues like this
Organizations commonly detect related issues through:
- Code review checks for verification tokens that are not revoked after successful use
- Static analysis and tests that trace token creation, validation, consumption, and expiration
- Integration tests covering email changes, active-user verification, and password-reset transitions
- Monitoring for repeated use of the same verification code or unusual password changes following email verification
- Policy enforcement requiring single-use, purpose-bound tokens for authentication-sensitive operations
Organizations commonly detect related issues through:
- Code review checks for verification tokens that are not revoked after successful use
- Static analysis and tests that trace token creation, validation, consumption, and expiration
- Integration tests covering email changes, active-user verification, and password-reset transitions
- Monitoring for repeated use of the same verification code or unusual password changes following email verification
- Policy enforcement requiring single-use, purpose-bound tokens for authentication-sensitive operations
