{"id":"CVE-2026-55186","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55186","summary":"MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow","details":"### Impact\nIn CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.","published":"2026-10-29T16:32:39Z","modified":"2026-10-29T16:45:04.428778410Z","cvss":{"score":4.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"silverstripe/mfa","fixedVersion":"6.0.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg"},{"type":"PACKAGE","url":"https://github.com/silverstripe/silverstripe-mfa"},{"type":"WEB","url":"https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0"},{"type":"WEB","url":"https://www.silverstripe.org/download/security-releases/cve-2026-55186"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T16:45:04.428778410Z"}}