Threats tagged 'ghsa-f757-9cxp-48rg'

Contao versions before 5.3.54, 5.7.17, and 6.0.6 do not invalidate existing user sessions when two-factor authentication (2FA) is enabled or disabled. This occurs because the user equality check and serialized session data omit the 2FA state, allowing attackers who already hold a session to retain access even after the legitimate user changes their 2FA settings.