CVE-2026-64798

Received Received - Intake

Persistent URL Login Key Weakness in Joomla

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Joomla! Project

Description

Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-64798

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-338	The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

Executive Summary

This vulnerability involves the generation of persistent URL login keys using a non-cryptographic random generator with insufficient entropy. This means the keys may be predictable or easily guessable, allowing unauthorized access to user accounts.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain unauthorized access to user accounts by guessing or predicting the login keys. This may lead to data breaches, unauthorized actions, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update Joomla to the latest version to ensure the random generator uses cryptographic methods. Review and regenerate all URL login keys to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-64798. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70