[MEDIUM] Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

PKSA-rsd9-mj5m-pj4f CVE-2026-71293 GHSA-jppw-r5j3-xf7x

Affected package: statamic/cms

Affected version: >=6.0.0-alpha.1,<=6.30.0

Reported by:
GitHub