MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

Medium · CVSS 4.2 (GHSA) · fetched 2026-10-29

### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.

Remediation

Upgrade silverstripe/mfa to 6.0.0 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-29T14:20:28-04:00 · https://github.com/advisories/GHSA-68wq-phq7-p2vg

← All threats