Contao's remember-me tokens will not be cleared after a password change

CVE-2024-30262

What is CVE-2024-30262?

A security vulnerability exists in Contao CMS where, before version 4.13.40, remember-me tokens remain active even after a frontend member changes their password. This oversight allows an attacker who has obtained a remember-me token to retain access to the compromised account despite the password change. The issue has been addressed in version 4.13.40, and users are advised to upgrade their systems promptly to ensure security. As a temporary workaround, disabling the 'Allow auto login' feature in the login module is recommended.

References