Answer in brief
CVE-2026-55186 records a Medium severity (CVSS 4.2) vulnerability in Silverstripe MFA: Can bypass MFA during password reset flow. The current sources do not mark it as known exploited. The current feed maps silverstripe/mfa (composer), silverstripe/silverstripe-mfa (generic), silverstripe/mfa (packagist). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps silverstripe/mfa (composer), silverstripe/silverstripe-mfa (generic), silverstripe/mfa (packagist). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| silverstripe/mfacomposer | <6.0.0 | 6.0.0 |
| silverstripe/silverstripe-mfageneric | <6.0.0 | 6.0.0 |
| silverstripe/mfapackagist | >=0 <6.0.0 | 6.0.0 |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 29, 2026
Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.
Quoted source text, attributed separately from HOL analysis.