CVE-2026-128335

EUVD-2026-125042
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
3.7 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.36%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
contaocontao
4.6.0 ≤
𝑥
< 5.3.54
CNA
contaocontao
𝑥
< 5.7.17
CNA
contaocontao
𝑥
< 6.0.6
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446
https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d
https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e
https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1
https://github.com/contao/contao/releases/tag/5.3.54
https://github.com/contao/contao/releases/tag/5.7.17
https://github.com/contao/contao/releases/tag/6.0.6
https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc
https://www.vulncheck.com/advisories/contao-before-5.3.54-5.7.17-and-6.0.6-session-invalidation-failure-on-2fa-change