CVE-2026-27128: 
PHP vulnerability analysis and mitigation

CVE-2026-27128 is a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability in Craft CMS's token validation service that can allow an attacker to reuse a single-use impersonation token beyond its intended usage limit. It affects Craft CMS versions >= 4.5.0-RC1 through <= 4.16.18 and >= 5.0.0-RC1 through <= 5.8.22. The vulnerability was discovered by researcher vitalysim and disclosed on February 23, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Craft CMS Advisory).

The root cause is a CWE-367 (TOCTOU Race Condition) in the getTokenRoute() method within src/services/Tokens.php. This method reads a token's usage count from the database, checks whether it is within the configured limit, and then updates the count — all as separate, non-atomic operations. An attacker who has obtained a valid, non-expired impersonation URL (via phishing, credential theft, or other means) can send a burst of concurrent HTTP requests to the token endpoint before the database update completes, causing the token to be accepted multiple times. The fix wraps the read-check-update sequence in a mutex lock (token:$token) to enforce atomicity and prevent concurrent access (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to reuse a single-use impersonation token multiple times, effectively bypassing the token usage limit. If the impersonation token belongs to a higher-privileged user account (e.g., an administrator), this constitutes a privilege escalation, granting the attacker unauthorized access to that account's capabilities and data. The confidentiality impact is rated High in CVSS v4.0 for both the vulnerable and subsequent systems, while integrity and availability are not directly impacted by the race condition itself (GitHub Advisory, Craft CMS Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.009% (1st percentile), indicating a very low probability of exploitation in the near term. Exploitation requires the attacker to already possess a valid, non-expired impersonation URL token (obtained through other means) and to successfully bypass any rate-limiting controls, making opportunistic exploitation unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain a valid impersonation token: Acquire a non-expired user account impersonation URL containing a limited-use token through phishing, social engineering, access to email/logs, or another vulnerability.
2. Identify the target endpoint: Parse the impersonation URL to identify the Craft CMS token endpoint (e.g., a URL containing the token parameter used by getTokenRoute()).
3. Bypass rate limiting: Assess and circumvent any rate-limiting mechanisms in place (e.g., using distributed requests, rotating IPs, or exploiting gaps in rate-limit configuration).
4. Send concurrent requests: Use a tool such as curl with parallel execution, Python's asyncio/aiohttp, or a race condition testing tool (e.g., Burp Suite's Turbo Intruder) to send multiple simultaneous HTTP requests to the impersonation URL before the database usage count is updated.
5. Achieve privilege escalation: If the token belongs to a higher-privileged account, one or more of the concurrent requests will succeed in establishing a session as that user, granting elevated access to the Craft CMS instance (GitHub Advisory, Craft CMS Advisory).

• Network: Burst of near-simultaneous HTTP requests to the Craft CMS token endpoint (e.g., URLs containing a token query parameter) from the same or multiple IP addresses within a very short time window.
• Logs: Craft CMS access logs showing multiple successful uses of the same token value within milliseconds; repeated getTokenRoute() calls for the same token string in application logs.
• Logs: Unexpected session creation events for high-privileged accounts (e.g., admin) without corresponding login events in the Craft CMS audit log.
• Database: Token records showing a usageCount exceeding the configured usageLimit, or tokens that should have been deleted still present in the craft_tokens table.

Craft CMS has released patched versions 4.16.19 and 5.8.23 that address this vulnerability by wrapping the token read-check-update sequence in a mutex lock, making the operation atomic. Users should upgrade to these versions immediately. No configuration-based workaround is available, but ensuring robust rate-limiting on token endpoints can reduce (but not eliminate) the exploitability window. Additionally, minimizing the distribution of impersonation URLs and ensuring they expire promptly reduces the attack surface (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher vitalysim and published by the Craft CMS maintainer angrybrad on February 23, 2026. The advisory received limited broader media coverage given its moderate severity and the significant preconditions required for exploitation. Social media activity was minimal, with automated CVE tracking accounts on Bluesky noting the disclosure shortly after publication (Craft CMS Advisory).