Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-55186 Can bypass MFA during password reset flow

CVE-2026-55186 Can bypass MFA during password reset flow

Severity:
Medium (?)
Identifier:
CVE-2026-55186
Versions Affected:
silverstripe/mfa: < 6.0.0
Versions Fixed:
silverstripe/mfa: 6.0.0
Release Date:
2026-10-28

In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.

Base CVSS: 4.2