- Package
- silverstripe/mfa
- Fixed in
- 6.0.0
- Published
- Thu 29 Oct 2026, 16:32 Lisbon
- Installs on Packagist
- 402K
In plain words
In CMS 5, the password reset flow lets someone change an MFA-enabled user's password and get a logged-in session without completing MFA. An attacker needs access to that user's email account. CMS 6 is not affected.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| silverstripe/mfa | < 6.0.0 | 6.0.0 |
Am I affected?
Look for silverstripe/mfa in composer.lock and check whether its version is below 6.0.0. Confirm whether your project uses CMS 5 and whether users have MFA enabled. The affected flow is password reset, and exploitation requires access to the user's email account. Version 6.0.0 is fixed; CMS 6 is not affected.
What to do
Check which version you have, then update to a fixed release for your branch (6.0.0):
composer show silverstripe/mfa | grep versions
composer update silverstripe/mfaIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
Impact
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel.
The advisory
- GitHub Advisory Database: GHSA-68wq-phq7-p2vg, with who is affected and how
- OSV.dev: GHSA-68wq-phq7-p2vg
- All advisories for silverstripe/mfa