CVE-2026-128335
Deferred Deferred - Pending Action

Contao Session Persistence After 2FA State Change

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128335
EUVD
EUVD-2026-125042

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
contao contao to 5.3.54 (exc)
contao contao to 5.7.17 (exc)
contao contao to 6.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Contao versions 4.6.0 to 5.3.53, 5.4.0-RC1 to 5.7.16, and 6.0.0-RC1 to 6.0.5 fail to invalidate user sessions when two-factor authentication (2FA) is enabled or disabled. This flaw allows attackers with an existing session to retain access even after the legitimate user changes 2FA settings, because session validation does not account for 2FA state changes.

Impact Analysis

If you use Contao with 2FA enabled or disabled, an attacker who gains access to your session could maintain that access even after you change 2FA settings. This could lead to unauthorized account access, data theft, or further compromise of your Contao installation.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure session management and access controls, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized session persistence may lead to data breaches or unauthorized access, triggering regulatory penalties.

Mitigation Strategies

Upgrade Contao to a patched version (5.3.54 or later, 5.7.17 or later, or 6.0.6 or later) to ensure proper session invalidation when 2FA settings change.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...