Joomla! CMS CVE-2026-48896

Exploitation requires that the targeted Joomla! site runs an affected version (4.0.0-5.4.5 or 6.0.0-6.1.0) with the core MFA feature enabled on the victim account, and that the attacker can reach the Joomla! login endpoint over the network. The CVSS 4.0 AT:P (Attack Requirements: Present) flag signals a non-default precondition: the attacker must possess or guess the victim's first-factor credentials (username and password), since the flaw bypasses only the second factor, not the entire authentication chain. PR:N and UI:N mean no Joomla! session and no victim interaction are required once those credentials are held. Sites that do not deploy MFA are not in scope for the bypass (though they are not protected by MFA either).

Signals are mixed and warrant a measured rather than emergency response. CVSS 4.0 scores this 8.2 with AV:N/AC:L/AT:P/PR:N/UI:N and VI:H only (no confidentiality or availability impact, no scope change) - meaning unauthenticated network exploitation is possible but requires a specific attack precondition (AT:P), namely that the targeted account already has MFA enrolled and the attacker holds or can obtain the first-factor credential. EPSS is 0.01% (2nd percentile) and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, all of which align with no public exploit identified at time of analysis. The vulnerability is not on the CISA KEV list. The realistic risk is therefore elevated for high-value Joomla! sites where MFA is the last line of defense against credential-stuffing or phishing, but it is not a drop-everything internet-wide threat. Note the apparent tension between AV:N/PR:N (network, unauthenticated) and the practical reality that bypassing 2FA presupposes possession of the first factor - the AT:P (attack requirements: present) flag captures this, and defenders should read the score accordingly.

An attacker who has obtained a valid Joomla! username and password through phishing, credential stuffing, or a prior breach attempts to log in to an account protected by MFA; by manipulating the login request sequence to exploit the missing state check, they advance to a fully authenticated session without ever satisfying the second-factor challenge. No public exploit identified at time of analysis, but given CWE-287 and a network-reachable login form, weaponization by a motivated actor with first-factor credentials is straightforward once the patch diff becomes public.