CVE-2026-55186Medium· 4.2▾ SunlitMultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
silverstripe/mfa < 6.0.0Upgrade to a patched release:
silverstripe/mfa 6.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55779Medium· 5.4Silverstripe Versioned provides versioning for Silverstripe models
CVE-2026-54720Medium· 5.4Silverstripe Framework: Possible XSS attack through media embed
CVE-2026-54721High· 8.8Silverstripe UserForms provides a visual form builder for the Silverstripe CMS
CVE-2026-54717Medium· 5.4Silverstripe CMS is an open source content management system
CVE-2026-63493High· 8.1Snipe-IT is an IT asset/license management system
CVE-2026-63190Critical· 9.4FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS