Joomla CMS EUVD-2026-89074

Exploitation requires a Joomla! site running an affected version (4.0.0-5.4.8 or 6.0.0-6.1.3) that has multi-factor authentication enabled - MFA must be in use for a 'bypass' to be meaningful. The specific trigger is the premature issuance of the 'rememberme' persistent-login cookie, so the rememberme/persistent-login functionality must be exercised in the authentication flow (reflected as AT:P, an attack requirement, in the CVSS 4.0 vector). Practically, the attacker must be able to drive the login process to the point the cookie is issued and then present that cookie; this presupposes access to first-factor login or the issued cookie, which limits fully anonymous exploitation despite the PR:N rating. Non-affected versions and sites not enforcing MFA are not at risk from this specific bypass.

This is a genuine MFA control-bypass in Joomla! core, a very widely deployed CMS, so it warrants attention despite lacking active-exploitation signals. The vendor CVSS 4.0 vector (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H) frames it as a network-reachable integrity-impacting flaw with an attack requirement (AT:P) - the 'premature issuance of a rememberme cookie' condition that must be present for the bypass to work. There is no EPSS score, no CISA KEV listing, and no public POC provided, so this is best treated as a latent risk rather than a confirmed exploitation campaign: no public exploit identified at time of analysis. Note a tension between PR:N and the nature of the flaw: an MFA bypass logically presupposes the attacker already possesses or can obtain first-factor credentials or a valid rememberme cookie, so 'unauthenticated' in the CVSS sense overstates how much an attacker gets for free - the second-factor protection is what is defeated. The vendor scoped confidentiality as VC:N and only integrity as VI:H, but in practice defeating MFA typically yields account access that also exposes data; verify the exact post-bypass access with the Joomla advisory. Overall: real priority for Joomla operators who rely on MFA, but not an internet-wide emergency absent POC/KEV.

An attacker targeting a Joomla site that enforces multi-factor authentication leverages the premature rememberme cookie: because the persistent-login cookie is issued before the MFA step completes, presenting or obtaining that cookie grants an authenticated session without satisfying the second factor. No public exploit code is available, but the attack is network-based and low-complexity once the rememberme condition is met.