CyberRota Analysis
AI-GeneratedStatamic CMS is vulnerable due to its user-augmentation resolver, which improperly exposes raw two-factor recovery codes without access restrictions. This flaw allows an attacker to retrieve a user's 2FA recovery codes through dynamic template rendering, potentially enabling them to bypass two-factor authentication. Organizations using Statamic CMS, especially those with dynamic rendering enabled in their templates, should prioritize addressing this vulnerability to protect user accounts from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.