Contao's remember-me tokens will not be cleared after a password change

CVE-2024-30262

What is CVE-2024-30262?

A security vulnerability exists in Contao CMS where, before version 4.13.40, remember-me tokens remain active even after a frontend member changes their password. This oversight allows an attacker who has obtained a remember-me token to retain access to the compromised account despite the password change. The issue has been addressed in version 4.13.40, and users are advised to upgrade their systems promptly to ensure security. As a temporary workaround, disabling the 'Allow auto login' feature in the login module is recommended.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References