CVE-2026-71293 Details

A vulnerability in Statamic CMS allows for the exposure of users' two-factor authentication recovery codes. This issue arises in the user-augmentation resolver, specifically within the 'AugmentedUser::get()' method. The vulnerability is present in Statamic CMS version 6.26.0 and possibly other versions in the 6.x branch. The problem stems from an explicit case that returns raw recovery codes without any access restrictions. Unlike other sensitive information such as passwords, which are properly guarded, the recovery codes are left unprotected and can be rendered into HTML responses via Antlers templates. This allows attackers to capture the codes and bypass two-factor authentication, provided they can exploit the template rendering settings.