Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109307Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

Medium 4.7

In plain English

A medium-severity cross-site scripting in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions.

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	5.0.0 – before 5.10.14

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-w5rh-mhxj-wr8r) vendor-advisory
VulnCheck Advisory: Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification third-party-advisory