Multi-Factor Authentication Bypass in Silverstripe CMS 5
CVE-2026-55186

4.2MEDIUM

Key Information:

Vendor

Silverstripe

Status
Silverstripe-mfa
Vendor
CVE Published:
3 November 2026

What is CVE-2026-55186?

The Silverstripe MFA component, utilized in Silverstripe CMS 5, has a vulnerability that allows an attacker to bypass the multi-factor authentication (MFA) process during the password reset flow. Specifically, if a logged-in user changes their password, they may inadvertently be granted a session before successfully completing the configured MFA challenge. An attacker with access to the user's email can exploit this flaw, effectively gaining unauthorized access. This issue has been addressed in version 6.0.0, which is not impacted by this vulnerability.

Affected Version(s)

silverstripe-mfa < 6.0.0

References

https://github.com/silverstripe/silverstripe-mfa/security...
x_refsource_CONFIRM
https://github.com/silverstripe/silverstripe-framework/pu...
x_refsource_MISC
https://github.com/silverstripe/silverstripe-mfa/pull/603
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.