Joomla CMS CVE-2026-48897

Exploitation requires that the target Joomla! site is running an affected version (4.0.0-5.4.5 or 6.0.0-6.1.0) and that the targeted account has multi-factor authentication enabled - accounts without MFA configured are not in scope of this bypass. The attacker must also possess valid first-factor credentials (username and password) for the target account, since the bug bypasses the second factor only, not the password check; this is reflected in the CVSS 4.0 AT:P (Attack Requirements: Present) modifier and the SSVC 'Automatable: no' judgement. No user interaction is needed from the victim and the attack is performed over the network against the standard Joomla! login endpoint.

The CVSS 4.0 score of 8.2 reflects a network-attackable (AV:N), low-complexity (AC:L) issue requiring no privileges or user interaction (PR:N/UI:N) with high integrity impact (VI:H) - but the AT:P (Attack Requirements: Present) modifier signals that exploitation requires specific pre-conditions, namely that a target account has MFA enabled and that the attacker already possesses the first-factor credentials. This is corroborated by the very low EPSS score (0.04%) and CISA SSVC scoring (Exploitation: none, Automatable: no, Technical Impact: partial), all of which indicate this is not a mass-exploitable bug. The vulnerability is not listed in CISA KEV and no public exploit has been identified, so realistic priority is moderate: patch promptly on internet-facing Joomla! sites that rely on MFA as a compensating control for weak or breached passwords, but it is not an emergency for sites without MFA enabled.

An attacker who has obtained a valid Joomla! username and password (e.g. via phishing, credential stuffing, or a prior breach) initiates the standard login against a target site that has MFA enabled for that account. By manipulating the authentication request sequence to skip or short-circuit the second-factor verification step, the attacker reaches an authenticated session without ever providing the TOTP code or other MFA factor, defeating the protection the site administrator believed was in place. No public proof-of-concept is currently identified.