CVE-2026-48897
Two-Factor Authentication Bypass in Joomla
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: Joomla! Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joomla | cms | From 4.0.0 (inc) to 5.4.5 (inc) |
| joomla | cms | From 6.0.0 (inc) to 6.1.0 (inc) |
| joomla | cms | 5.4.6 |
| joomla | cms | 6.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-48897 is a security vulnerability in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 that allows an authentication bypass in Multi-Factor Authentication (MFA).
The vulnerability occurs due to incorrectly reset session states, which enables attackers to bypass 2FA (two-factor authentication) checks.
This means that an attacker can potentially gain unauthorized access without completing the required second authentication step.
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass two-factor authentication, which significantly weakens the security of user accounts.
As a result, unauthorized users may gain access to sensitive information or administrative functions within the Joomla! CMS.
This can lead to data breaches, unauthorized changes, or other malicious activities on affected websites.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-48897, you should upgrade Joomla! CMS to versions 5.4.6 or 6.1.1 or later.
These versions contain the fix for the authentication bypass in Multi-Factor Authentication caused by incorrectly reset session states.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to bypass Multi-Factor Authentication (MFA) checks, potentially gaining unauthorized access to Joomla! CMS systems.
Such unauthorized access can lead to exposure or compromise of sensitive personal or protected health information, which may violate compliance requirements under standards like GDPR and HIPAA.
Therefore, if exploited, this vulnerability could negatively impact an organization's ability to maintain compliance with these regulations by failing to adequately protect user data through strong authentication mechanisms.