Vulnerabilityhigh
[20260914] - Core - MFA Authentication Bypass through rememberme cookies
AI summary · grok-4.7Summaries by Vani AI
Joomla remember-me cookies can bypass MFA on CMS 4.0.0–6.1.3; fixed in 5.4.9 and 6.1.4.
Joomla disclosed CVE-2026-92227, an authentication-bypass flaw in which a remember-me cookie is issued before MFA completes. It affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3. The project rates impact high and severity and probability moderate. Sites should upgrade to 5.4.9 or 6.1.4. No in-the-wild exploitation is mentioned.
Key facts
- CVE-2026-92227: premature remember-me cookie issuance bypasses MFA.
- Affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Vendor rates impact high, severity and probability moderate.
- Fixed in 5.4.9 and 6.1.4; reported by Google, Ada Logics, and Mukul Goyal.
- CVEs
- CVE-2026-92227
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- GoogleAda Logics
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92227 | MFA Bypass via Premature remember-me Cookie in Joomla Core 4.0.0–6.1.3 | 8.2 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: Moderate Probability: Moderate Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.