CVEvulnerability

CVE-2026-55186

4.2 MEDIUM Published 2026-11-03 Modified 2026-11-03 Official page ↗

Exploitation and prioritisation

CISA SSVC: exploitation
none
CISA SSVC: automatable
no
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-116372

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
Packagistsilverstripe/mfa< 6.0.06.0.0GHSA-68wq-phq7-p2vg
Status
Received
Published
2026-11-03
Last modified
2026-11-03
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.2 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-288

Description

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.

Related

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-68wq-phq7-p2vg MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow advisory · Packagist

References