Executive brief
The IP Login extension for Joomla, which allows users to automatically log into websites based on their IP address or specific URL keys, contains a security flaw in how it generates login credentials. The extension used a weak method for creating persistent URL login keys, making them easier for an attacker to guess or predict. If successfully exploited, an unauthorized person could potentially gain access to user accounts without knowing their actual passwords.
Technical details
The IP Login extension for Joomla (versions 1.0.0 through 6.2.5) utilizes a non-cryptographic random generator to create persistent URL login keys. This results in insufficient entropy (CWE-338), making the keys susceptible to brute-force or prediction attacks. An attacker who successfully predicts a valid login key can bypass authentication mechanisms to access user accounts. The vulnerability is rooted in the use of a weak PRNG instead of a cryptographically secure source of randomness. Users are advised to update to a version that implements secure key generation.
Affected products
- Regular Labs IP Login extension for Joomla 1.0.0 through 6.2.5
Timeline
- 2026-07-22: disclosed: CVE published by Joomla! Project