Improper Authentication in Contao - #VU165878
Published: November 11, 2026
Vulnerability identifier: #VU165878
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication scope restrictions and gain unauthorized access.
The vulnerability exists due to insufficient validation of passkey scope in Contao's passkey authentication when authenticating on websites with frontend member login. A remote attacker can use a registered passkey associated with one scope to authenticate in a different scope under certain circumstances and gain unauthorized access.
Affected software
Contao
Remediation
Install security update from vendor's website.
Contao - addressed in versions 5.7.17, 6.0.6