PT-2026-43320 · Joomla · Joomla!

Zeroxjacks · Published 2026-05-26 · Updated 2026-06-15 · CVE-2026-48902

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla (affected versions not specified)

Description The password and username reset features generate plain http links even when https connections are used, provided the "Force SSL" flag is not explicitly enabled. This leads to a transport encryption downgrade, where secure communications are reverted to an unencrypted state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BIT-JOOMLA-2026-48902

CVE-2026-48902

Affected Products

Joomla!

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-48902 · Security Note
• https://osv.dev/vulnerability/BIT-joomla-2026-48902 · Vendor Advisory
• https://developer.joomla.org/security-centre/1050-20260518-core-transport-encryption-downgrade-for-password-and-username-reset-links.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48902 · Vendor Advisory
• https://twitter.com/SecAlertsCo/status/2060264176472268897 · Twitter Post
• https://twitter.com/Hossted_OSS/status/2066495126906573101 · Twitter Post
• https://twitter.com/dailycve/status/2060193633542836656 · Twitter Post