CVE-2026-73337: Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Q: Which Joomla! Core versions are affected?

Joomla! Core versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are listed as affected. The provided information does not identify any unaffected fixed version.

Q: What is known about the conditions required to bypass MFA?

The issue is described as insufficient state checks that permit bypassing 2FA checks. The provided information does not specify the attacker’s required access level, whether authentication is required, or which configurations expose the bypass.

Published Aug 18, 2026

Updated

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Affected Software

1 affected component

Joomla Joomla! Core>=4.0.0<=5.4.7, >=6.0.0<=6.1.2

Event History

Aug 18, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionWeakness

Frequently Asked Questions

Which Joomla! Core versions are affected?

Joomla! Core versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are listed as affected. The provided information does not identify any unaffected fixed version.

What is known about the conditions required to bypass MFA?

The issue is described as insufficient state checks that permit bypassing 2FA checks. The provided information does not specify the attacker’s required access level, whether authentication is required, or which configurations expose the bypass.