Vulnerability GHSA-68wq-phq7-p2vg
Medium Risk
MEDIUM RISK
CVSS Score: 4.2
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 day ago
October 29, 2026 at 04:32 PM UTC
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
3.0.0-rc1 - 6.0.0-rc1
3.0.0-rc1 - 6.0.0-rc1
Summary
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
Details
Impact
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
Impacted packages
Timeline
Published
1 day ago
October 29, 2026 at 04:32 PM UTC
Fixed (6.0.0)
1 year ago
June 05, 2025 at 02:14 AM UTC
Last Modified
1 day ago
October 29, 2026 at 04:45 PM UTC