GHSA-68wq-phq7-p2vg: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
Other sources
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/silverstripe/mfato a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Frequently Asked Questions
Who is affected by this issue?
Users of CMS 5 who have multi-factor authentication enabled are affected. CMS 6 is not affected.
What does an attacker need to exploit the bypass?
The attacker needs access to the affected user's email account so they can use the password reset flow. They can then change the password and receive a logged-in session before completing MFA.