{"schema":"threatline.record/2","record":{"id":"GHSA-xh42-494x-2xgv","aliases":["GHSA-xh42-494x-2xgv"],"summary":"Verification code survives verify-email use and remains valid for set-password","details":"Craft’s user verification code is a single secret that authorizes two distinct unauthenticated actions — `users/verify-email` and `users/set-password` — but only one of those consumption paths invalidates it.\r\n\r\n`Users::verifyEmailForUser()` (`src/services/Users.php:982-1010`, 5.10.13.2) clears `verificationCode` only for \"pending\" users, via `activateUser()` (`:1004-1006`). For an already active user who is changing their email address, the function promotes `unverifiedEmail` to `email` and returns without clearing the code.\r\n\r\nThe same code is then accepted a second time by `users/set-password`, which performs a full password reset. `set-password` itself correctly nulls the code on use (`src/elements/User.php:2655`) — only the verify-email path leaks the second use.\r\n\r\nNet effect: one emailed code yields two independent account-recovery actions instead of one, and the victim’s own legitimate use of the code (verifying the new address) does not consume it.\r\n\r\n### Impact\r\n\r\nAn attacker who possesses a victim’s verification code — e.g., observed or leaked from a mailbox, shared inbox, or logs — and who lets (or tricks) the victim into completing the email-change verification can afterward reset the victim’s password with the same code and log in, after the victim reasonably believes the code was consumed. Honest precondition: the attacker must obtain the code out of band, and the flow starts with an email change to an active account.\r\n\r\nReport ID: 1683","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv","source_modified_at":"2026-10-05T17:31:03Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv","source_modified_at":"2026-10-05T17:31:03Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:31:03Z","modified_at":"2026-10-05T17:31:03Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-05T17:31:03Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:31:03Z","content_hash":"cb469b1511602222b78a420b4a8e31d46c0ad4c55037ed73956a65c1a2c2da3f"}}