If an administrator has enabled an OAuth provider that does not mandate email verification, an attacker can register an account at the identity provider using an email address belonging to an existing Statamic user. Upon successful OAuth authentication, the Statamic application incorrectly maps the attacker's session to the existing target account, granting the attacker full access to that user's privileges, including super-administrator rights. This bypasses standard password-based authentication and two-factor authentication, significantly increasing the risk of full site compromise.

Impact

The vulnerability allows unauthenticated attackers to hijack accounts, including highly privileged administrator accounts. Successful exploitation leads to full site administration, potentially enabling data exfiltration, backdooring the application, or modifying site content. The scope affects all Statamic deployments where OAuth is enabled with non-strictly configured third-party providers.

Recommendation

• Upgrade Statamic CMS to version 5.74.1 or 6.24.0 immediately to apply the fix for CVE-2026-64665.
• Review OAuth provider configurations in the Statamic control panel and ensure that only identity providers providing verified email attributes are in use.
• If current identity providers do not guarantee email verification, disable OAuth authentication until providers with secure configurations can be implemented.