cyfenced.com →

[ CVE-2026-55186 · Published 3 Nov 2026 ]

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

CVSS 4.2 EPSS <1%Fix available

[ Description ]Official description

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.

[ Fixes ]Fixes and patches

  • silverstripe/mfa 6.0.0Fixed version · GitHub Advisories · composer package silverstripe/mfa: upgrade to 6.0.0 or later (affected < 6.0.0)

[ Packages ]Affected open-source packages

[ References ]References