{"id":"CVE-2026-55186","aliases":["GHSA-68wq-phq7-p2vg"],"title":"MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow","summary":"MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow","severity":"medium","cvss":4.2,"cwe":["CWE-288"],"vendor":"silverstripe","product":"silverstripe/mfa","ecosystem":"composer","affected":["silverstripe/mfa < 6.0.0"],"patched":["silverstripe/mfa 6.0.0"],"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T16:32:40Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-68wq-phq7-p2vg","references":[{"url":"https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg"},{"url":"https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0"},{"url":"https://www.silverstripe.org/download/security-releases/cve-2026-55186"},{"url":"https://github.com/advisories/GHSA-68wq-phq7-p2vg"}],"tags":["ghsa","composer"],"ingestedAt":"2026-10-29T16:38:25.976Z","slug":"CVE-2026-55186","body":"## Overview\n\n### Impact\nIn CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.\n\n## Affected packages\n\n- `silverstripe/mfa < 6.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `silverstripe/mfa 6.0.0`","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}