CVE-2026-55186 — Vulnerability intelligence
PHP / Composer — silverstripe/mfa
Published:
- CVSS
- 4.2
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
### Impact
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.