Skip to content
laravel.now
Security advisoryCVE-2026-55186

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

Moderate4.2Published Modified Original advisory

As published by the sources

Affected packages

  • silverstripe/mfa
    Affected<6.0.0
    Fixed in6.0.0

Derived from the fixed versions above

What to do

  1. Upgrade silverstripe/mfa to 6.0.0 or later.

    composer update silverstripe/mfa --with-dependencies

To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.

Quoted from the original advisory

Details

Impact

In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.

References

laravel.now

The PHP and Laravel ecosystem, live.

laravel.now is an independent community project. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to Laravel, Laravel LLC, Taylor Otwell, or the Laravel framework maintainers. Laravel is a trademark of Taylor Otwell. All other trademarks belong to their respective owners.

This site is operated by the makers of Lockhound. Links to Lockhound are promotional.