Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the AugmentedUser::get function. An attacker can obtain sensitive two-factor authentication recovery codes by leveraging dynamic Antlers template rendering in a field configured to expose user...

CVE-2026-71293: Exposure of Sensitive Information to an Unauthorized Actor

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

PT-2026-68165

Name of the Vulnerable Software and Affected Versions Statamic CMS affected versions not specified Description The user-augmentation resolver AugmentedUser::get in src/Auth/AugmentedUser.php contains a case for the two factor recovery codes handle that returns raw two-factor recovery codes withou...