CVE-2026-92227

Joomla's core login flow issues the 'remember me' authentication cookie prematurely—before the user completes the multi-factor authentication (MFA) step—so the cookie itself grants an authenticated session. An attacker who already possesses a victim's valid username and password (reflected in the CVSS 'prior preparation' metric) can authenticate via the remember-me cookie path and skip the second-factor challenge entirely, gaining the ability to act as the victim, including administrators (high integrity impact; attacker can create or modify content, users, and settings). All sites running Joomla 4.0.0–5.4.8 or 6.0.0–6.1.3 that use MFA together with the remember-me feature are affected. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no exploitation in the wild has been reported as of this writing.

What to do: Update immediately to the latest Joomla release containing the 2026-09-14 core security fix (any version newer than 5.4.8 or 6.1.3). As an interim or defense-in-depth measure, disable the 'Remember Me' login option and invalidate existing remember-me cookies by forcing all users to re-authenticate. Review authentication and user-activity logs for logins that bypassed MFA, and rotate credentials for privileged accounts showing anomalous sessions.