CVE-2026-128335
Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.
| CWE | CWE-613 |
| Vendor | contao |
| Product | contao |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for contao contao
Be the first to know when new low vulnerabilities affecting contao contao are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Contao / Contao
4.6.0 < 5.3.54 5.4.0-RC1 < 5.7.17 6.0.0-RC1 < 6.0.6
References
github.com: https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc github.com: https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e github.com: https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d github.com: https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1 github.com: https://github.com/contao/contao/releases/tag/5.3.54 github.com: https://github.com/contao/contao/releases/tag/5.7.17 github.com: https://github.com/contao/contao/releases/tag/6.0.6 github.com: https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446 vulncheck.com: https://www.vulncheck.com/advisories/contao-before-5.3.54-5.7.17-and-6.0.6-session-invalidation-failure-on-2fa-change
Credits
Farhan Khan Martin Auswöger