CVE-2026-48902 - Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

CRITICAL

Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

Published May 26, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.33%

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
3.9.0-5.4.5	affected	-
6.0.0-6.1.0	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-319

Link	Providers	Tags
https://developer.joomla.org/security-centre/1050-20260518-core-transport-encryption-downgrade-for-password-and-username-reset-links.html		vendor-advisoryVendor Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner Joomla

Published May 26, 2026

Updated Jun 5, 2026

Reserved May 26, 2026

Updated May 28, 2026

Status Modified

Modified Jul 24, 2026

Severity n/a

Public date n/a