CVE-2026-73337

HighCVSS 8.2

Published: 18/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have an MFA authentication bypass vulnerability. Insufficient state checks lead to a vector that allows bypassing 2FA checks.

Risk Assessment

An attacker can bypass two-factor authentication, potentially leading to unauthorized access to administrator accounts and compromising the entire Joomla! installation.

Recommendation

Update Joomla! to a version that includes the fix (5.4.8 or later, 6.1.3 or later). Additionally, monitor login logs for suspicious activity.

Original NVD description (English source)

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.