CVE-2026-48902 describes a vulnerability in Joomla! CMS where the password and username reset features create plain HTTP links even when the site is accessed over HTTPS, if the 'Force SSL' flag is not explicitly set. This behavior can expose sensitive information such as reset tokens or credentials to interception over the network. The vulnerability affects Joomla! CMS versions from 3.9.0 through 5.4.5 and 6.0.0 through 6.1.0. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability allows sensitive information involved in password and username resets to be transmitted over unencrypted HTTP connections if the 'Force SSL' flag is not enabled. This can lead to interception and compromise of user credentials or reset tokens, potentially resulting in full system compromise. The CVSS score of 9.8 indicates a critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, administrators should ensure that the 'Force SSL' flag is explicitly enabled to enforce HTTPS for all connections, especially for password and username reset features, to prevent transmission of sensitive data over unencrypted channels.