CVE-2026-27593: 
PHP vulnerability analysis and mitigation

CVE-2026-27593 is a password reset link injection vulnerability in Statamic CMS that enables account takeover by allowing an attacker to capture a victim's password reset token and reset their password without authorization. It affects Statamic versions before 5.73.10 and versions 6.0.0-alpha.1 through 6.7.0 (the initial 6.3.3 fix was found to be insufficient). The vulnerability was published on February 23, 2026, and has a CVSS v3.1 score of 9.3 (Critical) per the GitHub Security Advisory (GitHub Advisory, Statamic Advisory).

The root cause is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). Statamic's ForgotPasswordController accepts a _reset_url POST parameter that specifies where the password reset link should point. In vulnerable versions, this parameter was not validated against a whitelist of known site domains, allowing an attacker to inject an arbitrary external URL. The fix introduced domain-level validation by parsing the host of the supplied _reset_url and comparing it against all configured site domains and the current request domain, rejecting any external URLs (GitHub Advisory, Patch Commit). The initial 6.3.3 patch used a string prefix check (Str::startsWith) which was bypassable (e.g., via domains like this-site.com.au matching this-site.com); the final fix uses strict hostname equality (Patch Commit).

Successful exploitation results in full account takeover: the attacker gains the ability to set a new password for the targeted user account, achieving high confidentiality impact (access to all data visible to that user), high integrity impact (ability to modify content and settings), and potentially high availability impact depending on the account's privileges. Because no authentication is required from the attacker and the scope is marked as Changed in the GitHub advisory's CVSS scoring, the impact can extend beyond the immediate user account to any resources accessible through it (GitHub Advisory, Statamic Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.017% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to know a valid account email address and to socially engineer the victim into clicking a password reset link they did not request, which limits opportunistic mass exploitation but makes targeted attacks feasible (Statamic Advisory).

1. Reconnaissance: Identify a target Statamic CMS site running a vulnerable version (< 5.73.10 or 6.0.0–6.7.0). Obtain the email address of a valid user account through public sources, site registration, or enumeration.
2. Craft malicious password reset request: Send a POST request to the site's password reset endpoint (/!/auth/password/email) with the victim's email in the email field and an attacker-controlled URL in the _reset_url parameter (e.g., _reset_url=https://attacker.com/capture).
3. Victim receives reset email: Statamic generates a legitimate password reset token and sends an email to the victim containing a reset link pointing to the attacker's domain (e.g., https://attacker.com/capture?token=<RESET_TOKEN>&email=victim@example.com).
4. Token capture: If the victim clicks the link (believing it to be legitimate or out of curiosity), the attacker's server logs the full URL including the reset token.
5. Password reset: The attacker uses the captured token to submit a password reset request to the legitimate Statamic site, setting a new password for the victim's account and completing the account takeover (GitHub Advisory, Statamic Advisory).

• Network: POST requests to /!/auth/password/email containing a _reset_url parameter pointing to an external or unexpected domain; outbound HTTP requests from the Statamic server to unfamiliar domains carrying reset token parameters.
• Logs: Web server or application logs showing password reset requests (POST /!/auth/password/email) with _reset_url values that do not match any configured site domain; subsequent successful password reset completions for accounts whose owners did not initiate a reset.
• Application: Unexpected password changes for user accounts, particularly shortly after a password reset email was sent; user reports of receiving unsolicited password reset emails.

Statamic has released patched versions 5.73.10 and 6.7.1 that fix this vulnerability by enforcing strict hostname validation on the _reset_url parameter. Note that the intermediate 6.3.3 fix was found to be insufficient due to a bypassable string prefix check; only 5.73.10 and 6.7.1 fully address the issue. Administrators should upgrade immediately; as a complementary measure, enabling multi-factor authentication (MFA) for user accounts can reduce the impact of a successful account takeover even if a reset token is captured (GitHub Advisory, Statamic Advisory).

The vulnerability was reported to Statamic by researchers credited as "Neosprings" and "everythingBlackkk" and was published by maintainer jasonvarga on February 23, 2026 (Statamic Advisory). Coverage appeared on The Hacker Wire and security aggregators shortly after disclosure, and the vulnerability was noted in community feeds on Mastodon and Bluesky. The follow-up finding that the initial 6.3.3 patch was insufficient prompted an updated advisory and additional commits, reflecting active community scrutiny of the fix quality.