CVE-2026-109307

4.7Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.7Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Attackers can run arbitrary JavaScript in an authenticated user's session and inherit their control panel permissions. This requires convincing a 2FA-enabled user to open a malicious login link during their 2FA verification flow.

Root cause

The control panel login and 2FA flow accepts unvalidated javascript: schemes in the user-controlled returnUrl parameter during client-side navigation.

Affected systems

Craft CMS 5.0.0 before 5.10.14

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Craft CMS to version 5.10.14 or later; no interim configuration workaround is provided.

shell

$ composer update craftcms/cms:^5.10.14

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109307