CVE-2026-55186

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to t...

CVE-2026-55186

The Silverstripe MFA component in Silverstripe CMS 5 is vulnerable to an authentication bypass during the password reset flow. An attacker with access to a user's email account can exploit this flow to change a password and obtain a logged-in session before completing the required multi-factor au...

CVE-2026-55186 Silverstripe MFA: Can bypass MFA during password reset flow

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to t...

EUVD-2026-116372

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to t...