BIT-JOOMLA-2026-48902 Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set...

CVE-2026-48902

The Joomla! CMS core contains a transport encryption downgrade vulnerability (CVE-2026-48902) affecting the password and username reset features. If the "Force SSL" flag is not explicitly enabled, these features generate plain HTTP links even when the connection is over HTTPS. This allows sensiti...