{"id":"CVE-2026-55186","kind":"vulnerability","aliases":["CVE-2026-55186","GHSA-68wq-phq7-p2vg"],"related":[],"title":"MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow","description":"### Impact\nIn CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.","summary":"In the SilverStripe MFA module, a user with multi-factor authentication enabled could reset their password and get a logged-in session before completing the second factor. An attacker who controls the victim's email account can sign in without the second factor.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"silverstripe/mfa","fixed":["6.0.0"],"affected":"< 6.0.0","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["cms","composer","cwe-288","package","php","silverstripe"],"not_affected_if":["cms-6","email-access-controlled","no-mfa-enabled-users"],"how_to_check":"- Check the installed version of `silverstripe/mfa` in `composer.lock`; versions below `6.0.0` are affected.\n- Confirm whether the site runs on CMS 5 (affected) or CMS 6 (not affected, per the advisory).","fix":"- `silverstripe/mfa`: upgrade to `6.0.0` or later.","status":"open","published_at":"2026-10-29T16:32:39+00:00","first_seen_at":"2026-10-29T16:33:51+00:00","triaged_at":"2026-10-29T16:35:33+00:00","updated_at":"2026-10-29T16:35:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:35:33Z","model":"claude-haiku-5-5","output":{"fix":"- `silverstripe/mfa`: upgrade to `6.0.0` or later.","reach":"internet","title":"SilverStripe MFA module: password reset skips second factor check","impact":"high","summary":"In the SilverStripe MFA module, a user with multi-factor authentication enabled could reset their password and get a logged-in session before completing the second factor. An attacker who controls the victim's email account can sign in without the second factor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["silverstripe","cms","php","composer"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as a user, bypassing MFA after reset","analyst_note":"","how_to_check":"- Check the installed version of `silverstripe/mfa` in `composer.lock`; versions below `6.0.0` are affected.\n- Confirm whether the site runs on CMS 5 (affected) or CMS 6 (not affected, per the advisory).","plain_action":"","needs_analyst":false,"not_affected_if":["cms-6","no-mfa-enabled-users","email-access-controlled"],"who_is_affected":"Sites running the SilverStripe MFA module below 6.0.0 on CMS 5 where users have MFA enabled. Exposure needs access to the victim's email account, since the reset flow is what is abused. The advisory says CMS 6 is not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4204,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-288':27B '-55186':14A,22A '5':79C '6':120C '68wq':17A 'access':112C 'account':68B,118C 'affect':123C 'attack':61B 'authent':2A,42B,91C,108C 'bypass':6A 'chang':93C 'cms':24B,78C,119C 'complet':56B,104C 'compos':25B 'control':63B 'could':44B 'cve':12A,20A 'cwe':26B 'email':67B,117C 'enabl':43B,92C 'exploit':109C 'factor':41B,59B,75B,90C,107C 'flow':11A,83C 'get':49B,97C 'ghsa':16A 'ghsa-68wq-phq7-p2vg':15A 'impact':76C 'let':84C 'log':52B,100C 'logged-in':51B,99C 'mfa':7A,34B 'modul':35B 'multi':40B,89C,106C 'multi-factor':39B,88C,105C 'multifactor':1A 'p2vg':19A 'packag':28B 'password':9A,47B,81C,95C 'php':29B 'phq7':18A 'requir':111C 'reset':10A,45B,82C 'second':58B,74B 'session':54B,102C 'sign':70B 'silverstrip':4A,30B,33B 'silverstripe/mfa':23A 'user':37B,86C,115C 'victim':65B 'without':72B","nicknames":[],"mitigations":[],"who_affected":"Sites running the SilverStripe MFA module below 6.0.0 on CMS 5 where users have MFA enabled. Exposure needs access to the victim's email account, since the reset flow is what is abused. The advisory says CMS 6 is not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:32:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-68wq-phq7-p2vg","url":"https://github.com/advisories/GHSA-68wq-phq7-p2vg","severity":"medium","published_at":"2026-10-29T16:32:39+00:00","modified_at":"2026-10-29T16:32:40+00:00","first_seen_at":"2026-10-29T16:33:51+00:00","fetched_at":"2026-10-29T16:33:51+00:00","note":null}],"documents":[{"id":17773,"url":"https://api.github.com/repos/silverstripe/silverstripe-mfa/security-advisories/GHSA-68wq-phq7-p2vg","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17774,"url":"https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17775,"url":"https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}