Live › vulnerability › CVE-2026-55186
In the SilverStripe MFA module, a user with multi-factor authentication enabled could reset their password and get a logged-in session before completing the second factor. An attacker who controls the victim's email account can sign in without the second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:33 UTC. All times on this page are UTC.
Sites running the SilverStripe MFA module below 6.0.0 on CMS 5 where users have MFA enabled. Exposure needs access to the victim's email account, since the reset flow is what is abused. The advisory says CMS 6 is not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| silverstripe/mfa | composer | < 6.0.0 | 6.0.0 |
silverstripe/mfa in composer.lock; versions below 6.0.0 are affected.silverstripe/mfa: upgrade to 6.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-55186")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.