CVE-2026-48902 — Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Published: 2026-05-26 · CVSS: 9.8 · CVSS 3.1

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Original CVE JSON · STIX 2.1

Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7