| Package | Affected versions | Patched versions |
|---|---|---|
| contao/core-bundle | < 4.13.40 | 4.13.40 |
| contao | < 4.13.40 | 4.13.40 |
When a front end member changes their password, the corresponding remember-me tokens are not removed.
Update to Contao 4.13.40.
Disable "Allow auto login" in the login module.
https://contao.org/en/security-advisories/remember-me-tokens-are-not-cleared-after-a-password-change
If you have any questions or comments about this advisory, open an issue in contao/contao.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free