4.2 Medium

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

CVE-2026-55186

Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.

Assessment

CVSS: 4.2 (v3.1)
Severity: Medium
Known exploited: Not listed in CISA KEV
Exploit availability: Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
Published: 29 October 2026
Last updated: 29 October 2026
Affected: composer · silverstripe/mfa
Weakness: CWE-288

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

At the source

GitHub Advisories

References

https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg
https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0
https://www.silverstripe.org/download/security-releases/cve-2026-55186
https://github.com/advisories/GHSA-68wq-phq7-p2vg

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-55186