EUVD-2026-31878
GHSA-w4ph-7vgc-vxrf
9.8
CVSS 3.1
Share
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Lifecycle Timeline
4
Analysis Generated
May 28, 2026 - 16:30 vuln.today
CVSS changed
May 28, 2026 - 14:22 NVD
9.8 (CRITICAL)
CVE Published
May 26, 2026 - 16:43 nvd
CRITICAL 9.8
CVE Published
May 26, 2026 - 16:43 nvd
UNKNOWN (no severity yet)
DescriptionNVD
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
AnalysisAI
Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated with plain HTTP URLs instead of HTTPS when the 'Force SSL' configuration flag is not explicitly enabled. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Joomla! installations and identify affected versions (3.9.0-5.4.5, 6.0.0-6.1.0). …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).