An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Joomla! | Joomla | 2.5.0 (including) | 3.10.6 (including) |
| Joomla! | Joomla | 4.0.0 (including) | 4.1.0 (including) |