GitHub Advisoryadvisory · Packagist
GHSA-68wq-phq7-p2vg MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
MEDIUM
Official page ↗
- Aliases
- CVE-2026-55186
- Ecosystem
- Packagist
- Packages
- silverstripe/mfa
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-288
- Reviewed
- 2026-10-29
Affected packages
• Packagist silverstripe/mfa: < 6.0.0 → fixed in 6.0.0
Description
Impact
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
Related
Alias · CVE (1)
- CVE-2026-55186 Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. vulnerability
Weakness · CWE (1)
- CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness
References
- https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/mfa/CVE-2026-55186.yaml web
- https://github.com/silverstripe/silverstripe-mfa package
- https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0 web
- https://www.silverstripe.org/download/security-releases/cve-2026-55186 web