CVE-2026-72780 affects Craft CMS prior to version 5.10.5. The issue arises because the system does not persist updated credential counters after validating WebAuthn assertions during passkey login. As a result, an attacker who captures a legitimate login request body containing requestOptions and response can replay this data to bypass authentication and establish additional authenticated sessions for the targeted user account. This flaw enables unauthorized access without requiring user interaction or elevated privileges.

Successful exploitation allows attackers to bypass authentication controls and gain unauthorized access to victim accounts by replaying captured login requests. This can lead to unauthorized session creation and potential account compromise. There is no indication of privilege escalation or impact beyond authentication bypass from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates that versions before 5.10.5 are affected, implying that upgrading to 5.10.5 or later may resolve the issue. Until an official fix or advisory is available, avoid using vulnerable versions and monitor vendor communications for patches.