MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

MEDIUM 4.2CVE-2026-55186 · GHSA-68wq-phq7-p2vg · Published 29/10/2026 · updated 29/10/2026

In short

CVE-2026-55186 is a MEDIUM (CVSS 4.2) vulnerability affecting silverstripe/mfa.
Fix: update to 6.0.0 or later.

Package	Affected versions	Patched versions
silverstripe/mfa Packagist	`< 6.0.0`	`6.0.0`

Description

Impact

In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.

References

silverstripe/silverstripe-mfa security advisory · WEB
silverstripe/silverstripe-mfa · PACKAGE
silverstripe/silverstripe-mfa release 6.0.0 · WEB
silverstripe.org/download/security-releases/cve-2026-55186 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free