CVE-2026-48902

The password and username reset mechanism in Joomla! creates links with an HTTP prefix instead of HTTPS in the case of encrypted connections, if the 'Force SSL' flag is not explicitly set in the configuration. This means that reset tokens are transmitted over an unencrypted channel, allowing them to be intercepted using man-in-the-middle techniques. An attacker monitoring network traffic can obtain the token and take control of the user account.

An attacker can intercept a password reset token or username sent via an unencrypted HTTP link and gain unauthorized access to the account of any user who initiated the reset process.

Apply patches available from the vendor according to the references (https://developer.joomla.org/security-centre/1050-20260518-core-transport-encryption-downgrade-for-password-and-username-reset-links.html). As a temporary measure, it is recommended to explicitly enable the 'Force SSL' flag in the Joomla! configuration to enforce the generation of reset links using HTTPS.

Joomla! — versions indicated in the vendor's references (security bulletin 20260518)