Read the docs
TI-2024-27845 Aliases CVE-2024-41800GHSA-wmx7-pw49-88jx

Craft CMS Allows TOTP Token To Stay Valid After Use

Priority HIGH 66CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00459 40th percentileScored 2026-11-07
Fix Fixed cms (craftcms): 5.2.3craftcms/cms (Packagist): 5.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Craft CMScms5.0.0-beta.1 to before 5.2.35.2.3Patch availableCNA
—craftcms/cms (Packagist)5.0.0-beta.1 to before 5.2.35.2.3Patch availableGHSA-wmx7-pw49-88jx
  • cms VendorCraft CMS Affected 5.0.0-beta.1 to before 5.2.3 Fixed in 5.2.3 Patch available CNA
  • craftcms/cms (Packagist) Vendor— Affected 5.0.0-beta.1 to before 5.2.3 Fixed in 5.2.3 Patch available GHSA-wmx7-pw49-88jx

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*5.0.1 to before 5.2.3VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta1:*:*:*:*:*:*5.0.0 beta1VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta10:*:*:*:*:*:*5.0.0 beta10VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta11:*:*:*:*:*:*5.0.0 beta11VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta2:*:*:*:*:*:*5.0.0 beta2VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta3:*:*:*:*:*:*5.0.0 beta3VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta4:*:*:*:*:*:*5.0.0 beta4VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta5:*:*:*:*:*:*5.0.0 beta5VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta6:*:*:*:*:*:*5.0.0 beta6VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta7:*:*:*:*:*:*5.0.0 beta7VulnerableCraft CMS
  • cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions 5.0.1 to before 5.2.3 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta1:*:*:*:*:*:* Versions 5.0.0 beta1 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta10:*:*:*:*:*:* Versions 5.0.0 beta10 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta11:*:*:*:*:*:* Versions 5.0.0 beta11 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta2:*:*:*:*:*:* Versions 5.0.0 beta2 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta3:*:*:*:*:*:* Versions 5.0.0 beta3 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta4:*:*:*:*:*:* Versions 5.0.0 beta4 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta5:*:*:*:*:*:* Versions 5.0.0 beta5 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta6:*:*:*:*:*:* Versions 5.0.0 beta6 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta7:*:*:*:*:*:* Versions 5.0.0 beta7 Vulnerable ·Craft CMS
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta8:*:*:*:*:*:*5.0.0 beta8VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:beta9:*:*:*:*:*:*5.0.0 beta9VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*5.0.0 rc1VulnerableCraft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta8:*:*:*:*:*:* Versions 5.0.0 beta8 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:beta9:*:*:*:*:*:* Versions 5.0.0 beta9 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:* Versions 5.0.0 rc1 Vulnerable ·Craft CMS

Remediation

  • Fix · CNA cms (craftcms) Fixed in 5.2.3
  • Fix · GHSA-wmx7-pw49-88jx craftcms/cms (Packagist) Fixed in 5.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41800
  2. 2026-10-03 Alias added: GHSA-wmx7-pw49-88jx

References

Patch 1

Advisory 3

Other 2

  • TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
  • TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
  • TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences