A vulnerability, which was classified as problematic, was found in Craft CMS up to 4.16.18/5.8.22. The affected element is the function
getTokenRoute. The manipulation results in time-of-check time-of-use.
This vulnerability is identified as CVE-2026-27128. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
