9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27593

CVE-2026-27593: Statamic is vulnerable to account takeover via password reset link injection

Impact

An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf.

The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset.

Patches

This has been fixed in 6.3.3 and 5.73.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27593

CVE-2026-27593:

9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	< 5.73.10	5.73.10
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.3.3	6.3.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the sendResetLinkEmail function within the ForgotPasswordController. The provided patches clearly show that this function was modified to add validation for the _reset_url parameter. Before the patch, the application did not properly validate this URL, or in some versions, did not validate it at all. This allowed an attacker to inject a URL to a malicious site. When a legitimate user requested a password reset, the email they received would contain a link pointing to the attacker's site, but with the user's valid password reset token appended. If the user clicked this link, the attacker could capture the token and use it to reset the user's password, thereby gaining control of the account. The identified vulnerable function, Statamic\Http\Controllers\ForgotPasswordController::sendResetLinkEmail, is the exact location in the code where this malicious input is processed and used to construct the password reset link.

Vulnerable functions

Statamic\Http\Controllers\ForgotPasswordController::sendResetLinkEmail

src/Http/Controllers/ForgotPasswordController.php

The `sendResetLinkEmail` function in `ForgotPasswordController` was vulnerable to an open redirect. An attacker could provide a `_reset_url` parameter pointing to an external domain. The application would then generate a password reset link using this malicious URL. When the victim clicks this link, the password reset token is sent to the attacker's server, allowing the attacker to take over the user's account. The patch added validation to ensure the `_reset_url` belongs to a whitelisted domain.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.