CVE-2026-73337: Joomla! MFA Authentication Bypass Flaw

CVE-2026-73337 Overview

CVE-2026-73337 is a multi-factor authentication (MFA) bypass vulnerability affecting Joomla! Core. The flaw stems from insufficient state checks in the authentication flow, allowing attackers to bypass the 2FA verification step. Affected versions include Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. The vulnerability is classified under [CWE-287] (Improper Authentication) and carries a network-based attack vector with no privileges or user interaction required.

Critical Impact
Remote attackers can bypass two-factor authentication protections on Joomla installations, gaining access to accounts protected by MFA using only primary credentials or an exploitable session state.

Affected Products

Joomla! Core versions 4.0.0 through 5.4.7
Joomla! Core versions 6.0.0 through 6.1.2
Joomla installations with MFA/2FA enabled

Discovery Timeline

2026-08-18 - CVE-2026-73337 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-73337

Vulnerability Analysis

The vulnerability resides in Joomla's multi-factor authentication verification workflow. Joomla's authentication process uses a two-stage model: primary credential validation followed by a secondary MFA challenge. The affected versions do not properly enforce state transitions between these stages. An attacker can manipulate the authentication state to skip the second-factor verification while retaining a valid authenticated session. This defeats the integrity guarantees that MFA is designed to provide for administrator and user accounts.

Root Cause

The root cause is insufficient state validation in the MFA challenge handler. The application fails to verify that a session has successfully completed the MFA challenge before granting full authenticated privileges. Because the state check is missing or incomplete, session variables or request parameters can be leveraged to advance the login state without providing the second factor. This falls under [CWE-287] Improper Authentication.

Attack Vector

Exploitation occurs over the network against the Joomla login endpoint. The attacker requires knowledge of valid primary credentials, such as a username and password obtained through phishing, credential stuffing, or prior breach. After submitting these credentials, the attacker manipulates the authentication flow to bypass the MFA challenge. No user interaction from the victim is required beyond the initial credential compromise. The result is unauthorized access to accounts that operators believed were protected by a second factor.

No public proof-of-concept exploit code is available at this time. Refer to the Joomla Security Advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-73337

Indicators of Compromise

Successful administrator or user login events on MFA-enabled accounts without a corresponding MFA challenge log entry.
Anomalous session activity where the authenticated user did not complete a two-factor prompt.
Login events originating from unusual IP addresses or geolocations for MFA-protected accounts.

Detection Strategies

Correlate Joomla authentication logs to identify sessions that reached authenticated state without an MFA verification event.
Monitor for repeated requests to MFA-related endpoints followed by successful session establishment.
Alert on administrative actions performed by accounts shortly after login when the MFA challenge log is absent.

Monitoring Recommendations

Enable verbose authentication logging on the Joomla application and forward logs to a centralized SIEM.
Track login velocity and failed authentication patterns against admin accounts.
Review web server access logs for unusual POST sequences to /administrator/index.php and MFA-related routes.

How to Mitigate CVE-2026-73337

Immediate Actions Required

Upgrade Joomla! Core to a patched release above 5.4.7 in the 5.x branch or above 6.1.2 in the 6.x branch as directed by the vendor advisory.
Force password resets for all administrator accounts and invalidate active sessions after patching.
Audit recent administrator activity for signs of unauthorized access.

Patch Information

Joomla has released security updates addressing this vulnerability. Site administrators should apply the fixed versions referenced in the Joomla Security Advisory. Updates should be applied through the standard Joomla Update component or by deploying the patched package from the Joomla project.

Workarounds

Restrict access to the /administrator/ path using web server rules or a web application firewall to trusted IP ranges until patching is complete.
Temporarily disable exposure of the Joomla login interface to the public internet where operationally feasible.
Enforce strong, unique passwords on all accounts to reduce the value of a primary-credential compromise while MFA is bypassable.

bash

# Example Apache configuration to restrict administrator access by IP
<Directory "/var/www/html/administrator">
    Require ip 203.0.113.0/24
    Require ip 198.51.100.10
</Directory>