CVE-2026-128335 · Package
NO FIX YET · SEE WHAT TO DO
Contao does not end existing user sessions when two-factor authentication is turned on or off for an account. An attacker who already holds a session cookie keeps access after the account owner changes their 2FA settings.
first public Nov 11, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running a Contao CMS version in the affected ranges with back-end or front-end users who use two-factor authentication. The risk needs an attacker who already holds a valid session, such as one stolen earlier, so sites without 2FA-protected users or with no session theft concern are lower priority. unknown whether public-facing front-end users are included.
Not affected if no-two-factor-users, patched-version
Who cares contao, php, self-hosted
Unknown from the sources.
5.3.54 or later for the 5.3 line5.7.17 or later for the 5.4 line6.0.6 or later for the 6.0 lineContao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.