---
title: "TYPO3-SA-2010-001: Vulnerability in TYPO3 Core"
url: "https://news.typo3.com/security/advisory/typo3-sa-2010-001"
description: It has been discovered that TYPO3 Core is vulnerable to authentication bypass.
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - "Product Updates & Roadmap"
  - Security
---

# TYPO3-SA-2010-001: Vulnerability in TYPO3 Core

- [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap)
- [Security](https://news.typo3.com/article/category/security-1)

TYPO3-SA-2010-001: Vulnerability in TYPO3 Core
==============================================

14 January 2010

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

It has been discovered that TYPO3 Core is vulnerable to authentication bypass.

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

**Component Type:** TYPO3 Core

**Affected Versions:** TYPO3 version 4.3.0 with enabled system extension "openid"

**Vulnerability Types:** Authentication Bypass

**Overall Severity:** High

**Release Date:** January 14, 2010

Vulnerable subcomponent #1: System extension openid
---------------------------------------------------

**Vulnerability Type:** Authentication Bypass

**Severity:** High

**CVE reference:** CVE-2010-0286

**Problem Description:** By using an OpenID identity that is assigned to an existing backend user account, an arbitrary website user is able to login to the TYPO3 backend with granted rights of this specific user account.

Prerequisites for exploiting this vulnerability is an enabled system extension "openid", knowledge of OpenID identities assigned to TYPO3 user accounts, a victim's OpenID identity of a specific type of OpenID provider and both victim and attacker having identities at the same OpenID provider. Only OpenID identities are vulnerable whose provider discards submitted OpenID identities during authentication process and allows its users to choose a different identity to authenticate with. The TYPO3 Security Team is aware of at least one major OpenID provider that exhibits such behaviour.

TYPO3 System extension "openid" is disabled by default; enabling it requires a manual change in system configuration.

**Solution:** When using OpenID for authentication, please update to the TYPO3 version 4.3.1 that fix the problem described.

**Credits:** Credits go to TYPO3 Core member Jeff Segars who discovered and reported the issue. Thanks to Dmitry Dulepov and Oliver Hader from the TYPO3 Core team for working on a patch.

**General Advice:** Follow the recommendations that are given in the [TYPO3 Security Cookbook](http://typo3.org/fileadmin/security-team/typo3_security_cookbook_v-0.5.pdf). Please subscribe to the [typo3-announce mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) to receive future Security Bulletins via E-mail.

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

[More posts by this author](https://news.typo3.com/article/author/marcus-krause)