[20260807] - Core - MFA Authentication Bypass
Joomla fixed CVE-2026-73337, an MFA authentication bypass caused by insufficient state checks, affecting Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260807 describes CVE-2026-73337, an authentication bypass in Joomla CMS multi-factor authentication. Insufficient state checks create a vector that allows 2FA checks to be bypassed; the vendor rates the impact as high with moderate probability. Affected versions are 4.0.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by bloman and Matej Rada on 2026-07-25.
- Insufficient state checks allow bypassing two-factor authentication checks
- Vendor rates impact as high with moderate probability
- Affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2
- Fixed in Joomla 5.4.8 and 6.1.3
- CVEs
- CVE-2026-73337
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73337 | MFA/2FA Authentication Bypass in Joomla CMS Core | 8.2 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: Moderate Probability: Moderate Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.