Description
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | typo3-src | 4.5.19+dfsg1-5+wheezy3 | DSA-2942-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms | < 6.2.0 | 6.2.0 | GHSA-h7wf-jg4f-x2wc |
Advisories 1
- DSA-2942-1 typo3-src - security update Debian Security (DSA / DLA) · Mar 9, 2026