{"action":"Upgrade silverstripe/mfa to 6.0.0 or later.","affected":[{"fixed":"6.0.0","introduced":"0"}],"component":"silverstripe/mfa","cve_ids":["CVE-2026-55186"],"ecosystem":"Packagist","epss":0.00278,"exploited":false,"fixed_versions":["6.0.0"],"ghsa_id":"GHSA-68wq-phq7-p2vg","id":"tcs_01M6495Q5RF3S0NNBGVBGEGPQA","modified_at":"2026-11-03T21:00:04.225678450Z","published_at":"2026-10-29T16:32:39Z","references":["https://osv.dev/vulnerability/GHSA-68wq-phq7-p2vg","https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg","https://github.com/silverstripe/silverstripe-mfa","https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0","https://www.silverstripe.org/download/security-releases/cve-2026-55186","https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/mfa/CVE-2026-55186.yaml"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-68wq-phq7-p2vg","url":"https://osv.dev/vulnerability/GHSA-68wq-phq7-p2vg"}],"summary":"MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow"}