-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing token invalidation in password change flows. The patch added deleteByUsername() calls in these specific handlers, proving these functions were vulnerable due to the absence of token cleanup. Each identified function handles critical password modification events where session termination was omitted before the fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| contao/core-bundle | composer | < 4.13.40 | 4.13.40 |