# CVE-2026-55186: SilverStripe MFA authentication bypass in password reset

Source: https://junglewise.ai/threats/cve-2026-55186-multifactor-authentication-for-silverstripe-can-bypass-mfa-during  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-55186 · Severity: medium · CVSS 4.2 · Published 2026-11-03

SilverStripe's multi-factor authentication (MFA) module for CMS 5 can be bypassed during the password reset flow. An attacker with access to a user's email account can reset the password and log in without completing MFA, gaining full account access and potentially accessing or modifying sensitive CMS content.

Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Silverstripe](https://junglewise.ai/threats/vendors/silverstripe).

## Quick answers

**Is CVE-2026-55186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55186 being exploited in the wild.

**How severe is CVE-2026-55186?** Medium severity, with a CVSS score of 4.2, published 3 November 2026.

**Which products and versions are affected?** silverstripe/mfa (Packagist) < 6.0.0, ECOSYSTEM:introduced=0,fixed=6.0.0; Silverstripe MFA < 6.0.0.

**Is there a fix for CVE-2026-55186?** Yes. silverstripe/mfa (Packagist): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55186 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55186?** Check whether you run silverstripe/mfa (Packagist) or Silverstripe MFA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- silverstripe/mfa (Packagist): upgrade to 6.0.0 or later

  ```sh
  composer require silverstripe/mfa:^6.0.0
  ```


## Technical details

The password reset flow in SilverStripe MFA < 6.0.0 grants a logged-in session before MFA verification is completed, bypassing the second factor authentication requirement. The attack requires email account access and network connectivity to initiate a password reset. CMS 6 is not affected; the fix is available in MFA version 6.0.0 and later.

## Affected products

- SilverStripe MFA < 6.0.0

## Identifiers

- CVE-2026-55186
- GHSA-68wq-phq7-p2vg

## Timeline

- 2026-10-29: disclosed

## References

- [https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg](https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg)