CVE-2026-112775

Craft CMS versions 5.0.0 before 5.11.0 are vulnerable to an authentication bypass due to verification code reuse . The root cause is that the users/verify-email endpoint fails to invalidate codes for active users. An attacker who obtains a victim's emailed code can submit it to users/set-password...