---
id: "CVE-2026-55186"
kind: "vulnerability"
aliases: ["CVE-2026-55186", "GHSA-68wq-phq7-p2vg"]
title: "MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "silverstripe/mfa", "fixed": ["6.0.0"], "affected": "< 6.0.0", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["cms", "composer", "cwe-288", "package", "php", "silverstripe"]
not_affected_if: ["cms-6", "email-access-controlled", "no-mfa-enabled-users"]
published_at: "2026-10-29T16:32:39+00:00"
first_seen_at: "2026-10-29T16:33:51+00:00"
updated_at: "2026-10-29T16:35:33+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-68wq-phq7-p2vg", "first_seen_at": "2026-10-29T16:33:51+00:00"}]
---

# MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

In the SilverStripe MFA module, a user with multi-factor authentication enabled could reset their password and get a logged-in session before completing the second factor. An attacker who controls the victim's email account can sign in without the second factor.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:silverstripe/mfa affected < 6.0.0 fixed 6.0.0

## How to check

- Check the installed version of `silverstripe/mfa` in `composer.lock`; versions below `6.0.0` are affected.
- Confirm whether the site runs on CMS 5 (affected) or CMS 6 (not affected, per the advisory).

## Fix

- `silverstripe/mfa`: upgrade to `6.0.0` or later.

## Timeline

- 2026-10-29T16:33:51+00:00 ghsa https://github.com/advisories/GHSA-68wq-phq7-p2vg

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/silverstripe/silverstripe-mfa/security-advisories/GHSA-68wq-phq7-p2vg
- [advisory] Maintainer's advisory: github.com https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg
- [fix] Release: github.com https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0

## From the sources

### Impact
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_