CVE-2026-81906

Concrete CMS prior to version 9.5.3 is affected by an OAuth callback login flaw. The vulnerable component is the OAuth callback login path , which failed to verify whether an account was active or email-validated before establishing a session. As a result, a deactivated or unvalidated user with a...