CVE-2026-128335

The Contao CMS (versions 4.6.0 before 5.3.54 , 5.4.0-RC1 before 5.7.17 , and 6.0.0-RC1 before 6.0.6 ) is vulnerable to a Session Invalidation Failure when modifying two-factor authentication (2FA) settings. The root cause is that the Contao\User::isEqualTo() function and serialized session data d...