https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 04 Nov 2026 23:18:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-55186 <p>Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user&#39;s configured multi-factor authentication challenge is completed. An attacker with access to the user&#39;s email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.</p> <p>Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user&#39;s configured multi-factor authentication challenge is completed. An attacker with access to the user&#39;s email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-55186 https://db.gcve.eu/vuln/ghsa-68wq-phq7-p2vg <p><strong>Affected:</strong> Packagist: silverstripe/mfa</p> <p>### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user&#39;s email account. CMS 6 is not affected.</p> <p><strong>Affected:</strong> Packagist: silverstripe/mfa</p> <p>### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user&#39;s email account. CMS 6 is not affected.</p> https://db.gcve.eu/vuln/ghsa-68wq-phq7-p2vg