Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
Published 23 Feb 2026 · Updated 24 Feb 2026
Affected packages
- Affected
- >=4.5.0-RC1 <4.16.19
- Fixed in
- 4.16.19
composer require craftcms/cms:^4.16.19- Affected
- >=5.0.0-RC1 <5.8.23
- Fixed in
- 5.8.23
composer require craftcms/cms:^5.8.23Details
A Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The getTokenRoute() method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes.
To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place.
For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user.
References
https://github.com/craftcms/cms/commit/3e4afe18279951c024c64896aa2b93cda6d95fdf
Is GHSA-6fx5-5cw5-4897 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.