GHSA-68wq-phq7-p2vg - MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
### Impact
In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
MEDIUM
Severity & confidence
Source severitymedium
Platform severitymedium
Confidencemedium
Exploitationunknown
CVSS4.2
Affected
Vendorssilverstripe
Productssilverstripe/mfa
Reporting sources (1)
GitHub Security Advisories
Timeline & provenance
Published2026-10-29T16:32:39
Last updated2026-11-03T17:16:27
Ingested2026-10-29T16:43:22
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a single or secondary source; treat as indicative, verify before acting.
Source type: vendor ยท Original: GitHub Security Advisories
