CVE-2019-10641
Contao Does Not Invalidate Existing Sessions When Password Changes
CVE-2019-10641 is a critical vulnerability (CVSS 9.8) in Contao Cms, published April 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in contao/contao 4.4.37.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 1.34%EPSS, 71st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.4.37contao/contao +9 more
Description
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/contaoPackagist | 4.0.0 up to 4.4.37 | 4.4.37 |
contao/contaoPackagist | 4.5.0 up to 4.7.3 | 4.7.3 |
contao/core-bundlePackagist | 4.0.0 up to 4.4.37 | 4.4.37 |
contao/core-bundlePackagist | 4.5.0 up to 4.7.3 | 4.7.3 |
contao/corePackagist | 3.0.0 up to 3.5.39 | 3.5.39 |
contao/contaoPackagist | 4.0.0 up to 4.4.37, plus listed versions 4.4.224.4.234.4.244.4.254.4.26 Show 10 moreShow less4.4.274.4.284.4.294.4.304.4.314.4.324.4.334.4.344.4.354.4.36 | 4.4.37 |
contao/contaoPackagist | 4.5.0 up to 4.7.3, plus listed versions 4.5.134.5.144.6.04.6.14.6.10 Show 19 moreShow less4.6.114.6.124.6.134.6.144.6.24.6.34.6.44.6.54.6.64.6.74.6.84.6.94.7.04.7.0-RC14.7.0-RC24.7.0-RC34.7.0-RC44.7.14.7.2 | 4.7.3 |
contao/core-bundlePackagist | 4.0.0 up to 4.4.37, plus listed versions 4.0.14.0.24.0.34.0.44.1.0 Show 45 moreShow less4.1.0-RC14.1.0-beta14.1.14.1.24.1.34.2.04.2.0-RC14.2.0-beta14.2.14.2.24.2.34.2.44.2.54.3.04.3.0-RC14.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.4.04.4.0-RC14.4.0-RC24.4.0-beta14.4.14.4.104.4.114.4.124.4.134.4.144.4.154.4.164.4.174.4.184.4.194.4.24.4.204.4.214.4.22 | 4.4.37 |
contao/core-bundlePackagist | 4.5.0 up to 4.7.3, plus listed versions 4.5.14.5.104.5.114.5.124.5.13 Show 34 moreShow less4.5.144.5.24.5.34.5.44.5.54.5.64.5.74.5.84.5.94.6.04.6.0-RC14.6.0-RC24.6.0-RC34.6.14.6.104.6.114.6.124.6.134.6.144.6.24.6.34.6.44.6.54.6.64.6.74.6.84.6.94.7.04.7.0-RC14.7.0-RC24.7.0-RC34.7.0-RC44.7.14.7.2 | 4.7.3 |
contao/corePackagist | 3.0.0 up to 3.5.39, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 Show 45 moreShow less3.0.63.1.03.1.13.1.23.1.33.1.43.1.53.1.RC13.1.beta13.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.153.2.163.2.173.2.183.2.193.2.23.2.203.2.213.2.33.2.43.2.53.2.63.2.73.2.83.2.93.2.RC13.2.beta13.2.beta23.3.03.3.0-RC13.3.0-RC23.3.0-beta13.3.13.3.23.3.33.3.43.3.53.3.63.3.7 | 3.5.39 |
What each source reports
NVD Score used
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
- Record
CVE-2019-10641- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-640
- Updated
- 2026-11-02
CVE ListNo score
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
- Record
CVE-2019-10641- Updated
- 2026-11-02
EUVDEUVD-2022-5339No score
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
- Record
EUVD-2022-5339- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vcgg-hp4r-87gx
Contao Does Not Invalidate Existing Sessions When Password Changes
Security researcher Ali Razzaq has discovered that existing sessions are not correctly invalidated when a user changes their password in the backend or frontend.
- Record
GHSA-vcgg-hp4r-87gx- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-640
- Updated
- 2026-11-02
OSV
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
- Record
CVE-2019-10641- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-vcgg-hp4r-87gx
Contao Does Not Invalidate Existing Sessions When Password Changes
Security researcher Ali Razzaq has discovered that existing sessions are not correctly invalidated when a user changes their password in the backend or frontend.
- Record
GHSA-vcgg-hp4r-87gx- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-640
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
contao.org/en/news.html
nvd.nist.gov/vuln/detail/CVE-2019-10641
github.com/contao/contao/commit/74c7dfafa0dfa5363a9463b486522d5d526e28fe
Show 4 moreShow less
Left out here: 70 versions. The JSON record has them.