CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.5 are vulnerable due to a failure to properly persist updated credential counters in the passkey login endpoint, allowing attackers to replay captured login requests. This could lead to unauthorized access, enabling attackers to create additional authenticated sessions for victim accounts. Organizations using affected versions should prioritize patching to mitigate the risk of account compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.