CVE-2026-73337: High MFA Authentication Bypass in Joomla

CVE-2026-73337 is an authentication bypass in Joomla core. Insufficient state checks allow the multi-factor authentication step to be bypassed. The record scores it 7.5, High. The Joomla notice lists affected versions as 4.0.0 to 5.4.7 and 6.0.0 to 6.1.2, and the fix as 5.4.8 or 6.1.3.

What's affected

The Joomla security notice, dated 7 August 2026 in its title, lists affected installs as Joomla CMS 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. Its solution is to upgrade to version 5.4.8 or 6.1.3. The notice shows a reported date of 25 July 2026 and a fixed date of 18 August 2026. The record gives the same ranges.

The notice lists only two fixed versions, one on the 5.x line and one on the 6.x line. It names no fixed 4.x release. A site on 4.x should plan a move to a supported line, and check the notice for any update on that point.

The description is brief. Insufficient state checks lead to a vector that allows two factor checks to be bypassed. The notice does not give the mechanism, and we will not guess at it. The weakness class is CWE-287, improper authentication.

How to check if you're exposed

Find the Joomla version of every site, including staging and forgotten test sites. In the administrator area, open System, then System Information, and read the Joomla version.

Compare it with the ranges above. A site on 4.0.0 through 5.4.7, or 6.0.0 through 6.1.2, is in the affected range. A site on 5.4.8 or 6.1.3 or later has the fix.

Next, see which accounts use multi-factor authentication. The flaw concerns that step, so sites that never enabled it have no second factor to bypass, though their password only login is the same as before. Administrator and super user accounts matter most. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for the packages it finds.

What to do now

1. Upgrade Joomla to 5.4.8 or 6.1.3, or later, depending on your line.
2. If you run Joomla 4.x, plan a move to a supported release, since the notice lists no 4.x fix.
3. Review administrator login history for sign ins you do not recognise.
4. Make sure admin passwords are unique, and reset any that may be reused elsewhere.
5. Limit access to the administrator path by IP address or a gateway where you can.
6. Update extensions and templates at the same time, since an upgrade is a good moment to do so.

Why it matters

Two factor authentication is a state machine. The server has to track which steps are done, and refuse to go on until each one passes. A gap in that tracking, where a step can be skipped by sending requests in an unexpected order, turns the second factor into a suggestion.

The sources differ on labels. The record scores it 7.5 High under CVSS 3.1. The Joomla notice lists impact as high but severity as moderate, with moderate probability. Joomla's labels are its own scale and are not a CVSS score. The two do not conflict on action, which is to upgrade. No source says the flaw has been exploited in the wild, and the CVE is not on the CISA KEV list.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Joomla security announcement 20260807

Last reviewed: 18 October 2026.