What the vulnerability does
Description
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
CVE-2026-48902
CVE-2026-48902: Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
CVSS base score
—
Key dates
Disclosure timeline
May 26, 2026
CVE published
June 5, 2026
Record updated
