CVE-2026-92227
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an MFA authentication bypass vulnerability due to premature issuance of a rememberme cookie. This allows bypassing the multi-factor authentication requirement.
Risk Assessment
An attacker who obtains the rememberme cookie can bypass MFA and gain unauthorized access to an account, potentially leading to account takeover and data breach.
Recommendation
Upgrade Joomla! to a patched version. Also consider invalidating all existing rememberme cookies and forcing re-authentication with MFA.
Other vulnerabilities in Joomla!
See all- CVE-2016-8870High
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.
- CVE-2015-8769High
SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2015-8565High
A directory traversal vulnerability in Joomla! versions 3.2.0 through 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
- CVE-2015-8564High
Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
- CVE-2015-8562High
Joomla! versions 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header.
- CVE-2015-7297High
Joomla! versions 3.2 before 3.4.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2014-6632High
Joomla! versions 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allow remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
- CVE-2026-73373Critical
Joomla! Core versions 1.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability of unrestricted uploads of SHTML files. The default list of dangerous files did not include SHTML files, which on servers that execute these files could lead to code execution.
- CVE-2026-65760Critical
Improper access checks in the Easy Store extension (versions 1.0.0-2.0.1) for Joomla allow logged-in users to retrieve order and customer information of any order in the system.
- CVE-2026-48904Critical
Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.
Original NVD description (English source)
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS