What’s Vulnerable › Vulnerabilities

CVE-2024-30262: Contao's remember-me tokens will not be cleared after a password change

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-09 · updated 2026-06-17
• Weakness: CWE-384

Description

Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.

Affected products

• contao: before 4.13.40 — fixed in 4.13.40

How to fix

Upgrade to a fixed version: contao 4.13.40. Check the vendor advisory for mitigations.

References

• https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9
• https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5
• https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9
• https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5

Get alerted when CVE-2024-30262 or the next vulnerability affects your stack