Password and Username Reset Vulnerability in Joomla

CVE-2026-48902

What is CVE-2026-48902?

A security flaw in Joomla's password and username reset features can lead to security vulnerabilities due to the generation of plain HTTP links for HTTPS connections when the 'Force SSL' flag is not set. This can expose sensitive information during the reset process and make it easier for attackers to intercept credentials. It is crucial for users to configure this setting correctly to ensure secure communications.

References