CVE-2026-55186: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
Other sources
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/silverstripe/mfato a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Frequently Asked Questions
Who is affected by this issue?
Deployments using CMS 5 with MultiFactor Authentication for SilverStripe are affected. CMS 6 is not affected.
What does an attacker need to exploit the bypass?
The attacker needs access to the affected user's email account so they can use the password reset flow. A successful reset can provide a logged-in session before MFA is completed.
What should be prioritized if immediate remediation is not possible?
Protecting access to user email accounts is critical, because email access is required to exploit the password-reset path. Monitor and investigate password reset activity for MFA-enabled accounts.