GHSA-f757-9cxp-48rgLowCVSS 3.7
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to...
🔗 CVE IDs covered (1)
📋 Description
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.
🔗 References (11)
- https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc
- https://nvd.nist.gov/vuln/detail/CVE-2026-128335
- https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d
- https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e
- https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1
- https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446
- https://github.com/contao/contao/releases/tag/5.3.54
- https://github.com/contao/contao/releases/tag/5.7.17
- https://github.com/contao/contao/releases/tag/6.0.6
- https://www.vulncheck.com/advisories/contao-before-5.3.54-5.7.17-and-6.0.6-session-invalidation-failure-on-2fa-change
- https://github.com/advisories/GHSA-f757-9cxp-48rg