{"id":"CVE-2026-128335","kind":"vulnerability","aliases":["CVE-2026-128335"],"related":[],"title":"Contao: existing sessions survive two-factor authentication changes","description":"Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.","summary":"Contao does not end existing user sessions when two-factor authentication is turned on or off for an account. An attacker who already holds a session cookie keeps access after the account owner changes their 2FA settings.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contao","package","php","self-hosted"],"not_affected_if":["no-two-factor-users","patched-version"],"how_to_check":null,"fix":"- Contao `5.3.54` or later for the 5.3 line\n- Contao `5.7.17` or later for the 5.4 line\n- Contao `6.0.6` or later for the 6.0 line","status":"open","published_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:58:56+00:00","updated_at":"2026-11-13T10:58:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:58:56Z","model":"claude-haiku-5-5","output":{"fix":"- Contao `5.3.54` or later for the 5.3 line\n- Contao `5.7.17` or later for the 5.4 line\n- Contao `6.0.6` or later for the 6.0 line","reach":"internet","title":"Contao: existing sessions survive two-factor authentication changes","impact":"low","summary":"Contao does not end existing user sessions when two-factor authentication is turned on or off for an account. An attacker who already holds a session cookie keeps access after the account owner changes their 2FA settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["contao","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker keeps a hijacked session after 2FA changes","analyst_note":"","how_to_check":"- Look at the Contao version in `composer.json` or `composer show contao/core-bundle`\n- Confirm whether the installed version is below `5.3.54`, `5.4.0-RC1` through `5.7.16`, or `6.0.0-RC1` through `6.0.5`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-two-factor-users"],"who_is_affected":"Sites running a Contao CMS version in the affected ranges with back-end or front-end users who use two-factor authentication. The risk needs an attacker who already holds a valid session, such as one stolen earlier, so sites without 2FA-protected users or with no session theft concern are lower priority. unknown whether public-facing front-end users are included.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.00076,"input_tokens":4743,"output_tokens":572,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-128335':12A,15A '-2026':11A,14A '2fa':58B,112C '4.6.0':61C '5.3.54':63C '5.4.0':64C '5.7.17':67C '6.0.0':69C '6.0.6':72C 'access':51B 'account':41B,54B 'alreadi':45B,102C 'attack':43B,101C 'authent':8A,33B,83C 'chang':9A,56B,111C 'contao':1A,16B,22B,60C,89C 'cooki':49B 'cve':10A,13A 'data':95C 'disabl':87C 'enabl':85C 'end':25B 'exist':2A,26B,76C 'factor':7A,32B,82C,99C 'fail':73C 'hold':46B,103C 'host':21B 'invalid':75C 'isequalto':91C 'keep':50B,106C 'omit':96C 'owner':55B,110C 'packag':17B 'php':18B 'rc1':65C,70C 'self':20B 'self-host':19B 'serial':93C 'session':3A,28B,48B,78C,94C,105C 'set':59B,113C 'state':100C 'surviv':4A 'turn':35B 'two':6A,31B,81C,98C 'two-factor':5A,30B,80C,97C 'user':27B,77C,90C","nicknames":[],"mitigations":[],"who_affected":"Sites running a Contao CMS version in the affected ranges with back-end or front-end users who use two-factor authentication. The risk needs an attacker who already holds a valid session, such as one stolen earlier, so sites without 2FA-protected users or with no session theft concern are lower priority. unknown whether public-facing front-end users are included.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["contao","low","package","php","selfhosted"],"campaign_type":null,"search_a":"'-128335':12A,15A '-2026':11A,14A 'authent':8A 'chang':9A 'contao':1A 'cve':10A,13A 'exist':2A 'factor':7A 'session':3A 'surviv':4A 'two':6A 'two-factor':5A","search_b":"'2fa':58B 'access':51B 'account':41B,54B 'alreadi':45B 'attack':43B 'authent':33B 'chang':56B 'contao':16B,22B 'cooki':49B 'end':25B 'exist':26B 'factor':32B 'hold':46B 'host':21B 'keep':50B 'owner':55B 'packag':17B 'php':18B 'self':20B 'self-host':19B 'session':28B,48B 'set':59B 'turn':35B 'two':31B 'two-factor':30B 'user':27B","search_c":"'2fa':112C '4.6.0':61C '5.3.54':63C '5.4.0':64C '5.7.17':67C '6.0.0':69C '6.0.6':72C 'alreadi':102C 'attack':101C 'authent':83C 'chang':111C 'contao':60C,89C 'data':95C 'disabl':87C 'enabl':85C 'exist':76C 'factor':82C,99C 'fail':73C 'hold':103C 'invalid':75C 'isequalto':91C 'keep':106C 'omit':96C 'owner':110C 'rc1':65C,70C 'serial':93C 'session':78C,94C,105C 'set':113C 'state':100C 'two':81C,98C 'two-factor':80C,97C 'user':77C,90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T07:19:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128335","severity":null,"published_at":"2026-11-13T10:18:13+00:00","modified_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null}],"documents":[{"id":145465,"url":"https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145466,"url":"https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145467,"url":"https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125696,"url":"https://github.com/contao/contao/releases/tag/5.3.54","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125697,"url":"https://github.com/contao/contao/releases/tag/5.7.17","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125698,"url":"https://github.com/contao/contao/releases/tag/6.0.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145471,"url":"https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T07:19:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145472,"url":"https://www.vulncheck.com/advisories/contao-before-5.3.54-5.7.17-and-6.0.6-session-invalidation-failure-on-2fa-change","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}