@NicolasDerumigny - how exactly do I do this:

"Try to log in twice with the exact same cookie using the cookie authentication plugin, triggering a failed login" ?

I'll gladly test the PR, I just don't know how to do that?

@NicolasDerumigny - how exactly do I do this:

"Try to log in twice with the exact same cookie using the cookie authentication plugin, triggering a failed login" ?

I'll gladly test the PR, I just don't know how to do that?

@NicolasDerumigny Could you define the testing instructions in more detail or provide a screenshot or video? That would be great. Thank you.

Sure !

1. Log in on the website while checking "remember me"
2. In Firefox, open developer console -> Storage -> Cookies, right-click and "Delete All Session Cookies"
3. In the JS console, execute

Promise.all([fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'})])

Which pings ~20 times Joomla, triggering a race issue which should trigger the message.

Hello @NicolasDerumigny thank you for your PR and your testing description, now it's clear and I can reproduce the issue.

I think you found here two issues:

• the language string is not translated
• the "user_id" does not contain the ID but the user name, so the string itself is not correct and would need a "%s" instead of an "%u"

For the first issue I think your fix can be make easier, because plugins have a $this->loadLanguage() method, which loads the language file for the plugin. So no need to change the code, just add this call a line above. Then probably you could also fix the language string itself? Thank you!

Sure !

1. Log in on the website while checking "remember me"
2. In Firefox, open developer console -> Storage -> Cookies, right-click and "Delete All Session Cookies"
3. In the JS console, execute

Promise.all([fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}, {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'}),fetch("/component/ajax/?format=json", {method: 'POST'})])

Which pings ~20 times Joomla, triggering a race issue which should trigger the message.

Hi @NicolasDerumigny, I have done this in 2 different browsers, and I can't seem to find in any logs :

Joomla's log logs PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED

/error_log or /administrator/error_log or /administrator/logs/error.php
(I even turned on Log Deprecated API and Log Almost Everything thinking I needed to do that, and nothing...)

;(

That's strange, especially given the fact that @bembelimen seems to have reproduced it. Are you sure to have deleted session-local cookies before each try? Else the browser will authenticate using session cookies and not remember me ones, which will not trigger the bug.

@bembelimen : I will update the string as soon as I can

I have tried several times, but I cannot find the error in the Joomla log.
Perhaps I did not understand the procedure described.

@NicolasDerumigny please also change the language string as suggested. We’ll then test it again and look forward to merging the PR.

@NicolasDerumigny please also change the language string as suggested. We’ll then test it again and look forward to merging the PR.

We’ve discussed this again and the language string actually needs to be fixed separately in 5.4-dev.

I’ve been looking into this for the last hour, and even in version 5.4 the string isn’t being translated correctly in the log.

2026-06-19T09:04:46+00:00	INFO	127.0.0.1	joomlafailure	Empty password not allowed.
2026-06-19T09:06:49+00:00	WARNING	127.0.0.1	security	PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED

@NicolasDerumigny we now have two quick options.

1. You close this PR and create a new PR for 5.4, and we’ll handle the upmerge.
2. I’ll create a new PR for 5.4.

If you’re creating the PR for version 5.4 from scratch, please add
$this->loadLanguage();
to line 110 so that we can translate all the strings in future.

@tecpromotion it will be faster if you handle it, I do not have much time in the short term. However, I'd like to underline that the cookie authentication mechanism also have a concurrency issue that I pointed out in #46587 that you may want to look at after merging the translation fix.

In consultation with @NicolasDerumigny, this PR will be closed and replaced by #47985.