[HIGH] Statamic: Account takeover via OAuth email matching without email-verification check

PKSA-vbqf-w9v5-8bfs CVE-2026-64665 GHSA-93qh-5269-9wcf

Affected package: statamic/cms

Affected version: >=6.0.0,<6.24.0|<5.74.1

Reported by:
GitHub