User Validation Hash Issue in Concrete CMS by Concrete

CVE-2026-81905

What is CVE-2026-81905?

Concrete CMS versions prior to 9.5.3 exhibit a vulnerability in how user validation hashes are managed. The system stores hashes for various functions such as email/registration validation and password resets in a unified database table without properly verifying the type of hash during the redemption process. This flaw allows an attacker to misuse a hash intended for one purpose, for example, using a long-lived registration hash to change passwords or an email validation hash to activate an account. To exploit this vulnerability, an attacker must first acquire a valid hash through means like email interception or log exposure, which could significantly amplify the risk of data breaches following any hash disclosure. This mechanism highlights the necessity for secure validation processes in handling user authentication tokens.

References