Medium · 6.5 CVE-2020-26136 BIT-silverstripe-2020-26136EUVD-2021-1357GHSA-mg2g-8pwj-r2j2

Authentication bypass in SilverStripe GraphQL

Published Jun 8, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.

Ecosystem	Package	Affected	Fixed	Record
Packagist	silverstripe/graphql	>= 3.0.0, < 3.5.0	3.5.0	GHSA-mg2g-8pwj-r2j2
Packagist	silverstripe/graphql	>= 4.0.0-alpha1, < 4.0.0-alpha2	4.0.0-alpha2	GHSA-mg2g-8pwj-r2j2