Home

Description

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

PUBLISHED Reserved 2026-05-26 | Published 2026-05-26 | Updated 2026-06-05 | Assigner Joomla

Product status

Default status
unaffected

3.9.0-5.4.5
affected

6.0.0-6.1.0
affected

Credits

@ZeroXJacks, https://github.com/ZeroXJacks finder

References

developer.joomla.org/...ssword-and-username-reset-links.html vendor-advisory

cve.org (CVE-2026-48902)

nvd.nist.gov (CVE-2026-48902)

Download JSON