CVE-2026-128335: Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.3.54 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.7.17 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 6.0.6
Event History
Frequently Asked Questions
What must an attacker already have to exploit this issue?
The attacker must already hold a valid user session. Exploitation also requires the affected user to enable or disable two-factor authentication, after which the existing session remains valid.
Which deployments are affected?
Affected release ranges are Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6. The issue concerns existing sessions when a user changes their two-factor authentication setting.
How can I determine whether a session may still be valid after a 2FA change?
On an affected version, sessions created before a user enables or disables two-factor authentication are not invalidated by that change. A previously obtained session may therefore continue to work after the setting is changed.