UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128335

Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change

Severity
Low 2.1
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
5.3.54, 5.7.17, 6.0.6
Weakness
Insufficient session expiration (CWE-613)
Attack
Over the network · Only under certain conditions · Needs a user account · Needs someone to view a page or file
Attacker can
Read some data · Change some data
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.

From the CVE Program.

Affected software

SoftwareAffected versions
ContaoServers and applications · cna:contao|contao
  • From 4.6.0 before 5.3.54
  • From 5.4.0-RC1 before 5.7.17
  • From 6.0.0-RC1 before 6.0.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128335