CVE-2026-48896

Vulnerability

Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 contain insufficient state checks in the multi-factor authentication (MFA) implementation. This allows an attacker to bypass 2FA requirements without proper verification. Affected versions include all releases in those ranges.

Exploitation

An attacker with network access to a Joomla! site can exploit this vulnerability by manipulating the authentication flow, leveraging the insufficient state checks to skip the second factor. No prior authentication is required, and the attack can be executed remotely.

Impact

Successful exploitation allows the attacker to log in as any user without providing the second authentication factor, effectively compromising that user's account. This can lead to unauthorized access to sensitive data, content manipulation, or further privilege escalation depending on the compromised user's permissions.

Mitigation

Upgrade to Joomla! CMS version 5.4.6 or 6.1.1, released on 2026-05-26, which fixes the state check logic. No workarounds are available for unpatched versions. The vulnerability is not known to be listed in CISA's KEV as of the publication date.

Reference: [1]