Is CVE-2026-55186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55186 being exploited in the wild.

How severe is CVE-2026-55186?

Medium severity, with a CVSS score of 4.2, published 3 November 2026.

Which products and versions are affected?

silverstripe/mfa (Packagist) < 6.0.0, ECOSYSTEM:introduced=0,fixed=6.0.0; Silverstripe MFA < 6.0.0.

Is there a fix for CVE-2026-55186?

Yes. silverstripe/mfa (Packagist): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55186 attacked?

It is attacked over the network.

Am I affected by CVE-2026-55186?

Check whether you run silverstripe/mfa (Packagist) or Silverstripe MFA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55186: SilverStripe MFA authentication bypass in password reset

Q: Is there a fix for CVE-2026-55186?

Yes. silverstripe/mfa (Packagist): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55186 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-55186?

Check whether you run silverstripe/mfa (Packagist) or Silverstripe MFA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55186 · Severity: medium · CVSS 4.2 · Published 2026-11-03

SilverStripe's multi-factor authentication (MFA) module for CMS 5 can be bypassed during the password reset flow. An attacker with access to a user's email account can reset the password and log in without completing MFA, gaining full account access and potentially accessing or modifying sensitive CMS content.

Vendors: Packagist, Silverstripe.

Quick answers

Is CVE-2026-55186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55186 being exploited in the wild.
How severe is CVE-2026-55186?: Medium severity, with a CVSS score of 4.2, published 3 November 2026.
Which products and versions are affected?: silverstripe/mfa (Packagist) < 6.0.0, ECOSYSTEM:introduced=0,fixed=6.0.0; Silverstripe MFA < 6.0.0.
Is there a fix for CVE-2026-55186?: Yes. silverstripe/mfa (Packagist): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55186 attacked?: It is attacked over the network.
Am I affected by CVE-2026-55186?: Check whether you run silverstripe/mfa (Packagist) or Silverstripe MFA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

silverstripe/mfa (Packagist): upgrade to 6.0.0 or later
```
composer require silverstripe/mfa:^6.0.0
```

Technical details

The password reset flow in SilverStripe MFA < 6.0.0 grants a logged-in session before MFA verification is completed, bypassing the second factor authentication requirement. The attack requires email account access and network connectivity to initiate a password reset. CMS 6 is not affected; the fix is available in MFA version 6.0.0 and later.

Affected products

SilverStripe MFA < 6.0.0

Identifiers

CVE-2026-55186
GHSA-68wq-phq7-p2vg

Timeline

2026-10-29: disclosed

References

https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.