Description
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Contao | Contao | 4.6.0 – < 5.3.54, 5.4.0-RC1 – < 5.7.17, 6.0.0-RC1 – < 6.0.6 | 5.3.54 |
Advisories 1
- WID-SEC-2026-4516 Contao: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- GitHub Security Advisory (GHSA-5mg3-mv6j-57wc) vendor-advisory
- https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e patch
- https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d patch
- https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1 patch
- Contao 5.3.54 Release Notes release-notes
- Contao 5.7.17 Release Notes release-notes
- Contao 6.0.6 Release Notes release-notes
- https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446 technical-description
- VulnCheck Advisory: Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change third-party-advisory