Joomla! Password and Username Reset Link Downgrade Vulnerability

A vulnerability exists in Joomla! CMS versions 3.9.0 prior to 5.4.5 and 6.0.0 prior to 6.1.0, where the password and username reset features generated plain HTTP links for HTTPS connections, unless the 'Force SSL' flag was explicitly enabled. This flaw creates a mixed content issue, potentially exposing users to security risks by downgrading the transport encryption of these critical links.

Impact

This vulnerability could lead to a mixed content issue, where secure HTTPS connections are downgraded to HTTP, potentially exposing sensitive information during the password and username reset process.

Remediation

Users can upgrade to Joomla! CMS version 5.4.6 or 6.1.1 to address this vulnerability.