CVE-2020-26228

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

• CWE-312

• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-954j-f27r-cj52Third Party Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2020-011Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-954j-f27r-cj52Third Party Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2020-011Vendor Advisory

Published

Nov 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26222Dependabot is a set of packages for automated dependency man…8.8
• CVE-2020-26223Spree is a complete open source e-commerce solution built wi…6.5
• CVE-2020-26224In PrestaShop before version 1.7.6.9 an attacker is able to …7.5
• CVE-2020-26225In PrestaShop Product Comments before version 4.2.0, an atta…6.1
• CVE-2020-26226In the npm package semantic-release before version 17.2.3, s…8.1
• CVE-2020-26227TYPO3 is an open source PHP based web content management sys…6.1
• CVE-2020-26229TYPO3 is an open source PHP based web content management sys…3.7
• CVE-2020-2623Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26230Radar COVID is the official COVID-19 exposure notification a…5.3
• CVE-2020-26231October is a free, open-source, self-hosted CMS platform bas…6.7
• CVE-2020-26232Jupyter Server before version 1.0.6 has an Open redirect vul…5.4
• CVE-2020-26233Git Credential Manager Core (GCM Core) is a secure Git crede…7.3