Medium severity4.2NVD Advisory· Published Oct 29, 2026· Updated Oct 29, 2026

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

CVE-2026-55186

Description

Impact

In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-68wq-phq7-p2vgghsaADVISORY
github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0ghsa
github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vgghsa
www.silverstripe.org/download/security-releases/cve-2026-55186ghsa

News mentions

No linked articles in our index yet.