The vulnerability causes Joomla's password and username reset features to generate plain-HTTP links unless the Force SSL option is explicitly enabled. This downgrade allows an attacker who can observe or tamper with traffic to intercept or modify the reset links, potentially capturing reset tokens or user credentials. The defect results in exposure of sensitive data over an insecure channel.

The affected product is Joomla! CMS under the Joomla! Project. Any installation that does not enable Force SSL for password and username reset functionality is considered vulnerable; no specific version numbers are listed in the advisory.

Because the reset links travel unencrypted, the risk is tied to any network segment where HTTP traffic could be monitored. It is inferred that an attacker could capture a reset token from the URL and use it to perform a credential reset, effectively taking over the user’s account. The EPSS score of < 1% indicates a low probability of exploitation in the wild, yet the CVSS score of 9.8 reflects a critical severity for those exposed to the attack vector. The vulnerability is not listed in CISA KEV.