CVE-2026-55186

The record

Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.

Affected packages

Related vulnerabilities

• CVE-2026-77799 ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor… CWE-288
• CVE-2026-71450 Authentication bypass using an alternate path or channel vulnerability in Johnson… CWE-288
• CVE-2026-116606 An authentication bypass in Barracuda Email Security Gateway versions earlier than… CWE-288
• CVE-2026-115829 In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step… CWE-288
• CVE-2026-119420 Lago through 1.55.0 contains an authentication bypass vulnerability that allows… CWE-288
• CVE-2026-118572 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth… CWE-288
• CVE-2026-118582 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA… CWE-288
• CVE-2026-118554 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID… CWE-288