Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-48902 EUVD-2026-31878GHSA-w4ph-7vgc-vxrf

Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

Published May 26, 2026 · Updated Jun 5, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Affected products

VendorProductAffectedFixed
Joomla! Project Joomla! CMS 3.9.0-5.4.5, 6.0.0-6.1.0 —

Advisories 1

References