silverstripe/silverstripe-mfa · Security
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
- GHSA ID
- GHSA-68wq-phq7-p2vg
- CVE ID
- CVE-2026-55186
- Severity
- medium
- Published
- Updated
- CVSS
- 4.2 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS v3
- 4.2 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
Impact
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
CWEs
- CWE-288 · Authentication Bypass Using an Alternate Path or Channel