CVE-2026-128335

Description

Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.

References

• https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446
• https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d
• https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e
• https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1
• https://github.com/contao/contao/releases/tag/5.3.54