CVE-2026-92227 is an authentication bypass in Joomla. The remember-me cookie is issued too early in the login flow, which lets a login skip multi-factor authentication. It affects Joomla 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3. NVD scores it High (7.5). Update to 5.4.9 or 6.1.4.
What's affected
Joomla's announcement lists 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3 as affected and names 5.4.9 and 6.1.4 as the upgrade targets. The NVD record matches.
The weakness is CWE-287, improper authentication. The record's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
The sources use different labels. NVD scores it 7.5 (High). Joomla's announcement lists impact High, severity Moderate and probability Moderate. The impact word is the one to focus on if you rely on multi-factor authentication to protect administrator accounts.
How to check if you're exposed
Check your Joomla version under System, then System Information. Below 5.4.9 on 5.x or below 6.1.4 on 6.x is affected.
Next, find out whether you depend on multi-factor authentication and the remember-me feature. If your administrators use MFA and the remember-me option is enabled, the bypass undermines the control you thought you had. If neither is in use, your exposure is different, though upgrading is still the right step.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update to Joomla 5.4.9 or 6.1.4 after a backup.
- Review the authentication log for sign-ins that did not include the MFA step you would expect.
- Consider turning off remember-me on administrator logins until the update is done.
- Ask administrators to sign out everywhere after the update so old cookies stop working.
Why it matters
Multi-factor authentication only helps if no session or cookie is created before the second factor is checked. The announcement says a remember-me cookie was issued prematurely, which means the system recorded a trusted login before the whole check was complete. A client holding that cookie could skip the remaining step.
This kind of flaw is easy to miss in testing because the normal path works. The question to ask of any login flow is what state exists at each step and what a client can do with it. The record's KEV flag is false and the announcement does not report exploitation.
Quick check
Does this remove MFA entirely?
The announcement describes a bypass through the remember-me cookie. It does not say every login is exposed, so read it as a gap in how the cookie is issued.
Which fixed versions apply?
Joomla 5.4.9 and 6.1.4.
Sources
Last reviewed: 18 October 2026.
