Intermittent UE_SESSION_EXPIRED / invalid CSRF token during login on Joomla 6

we are experiencing intermittent login failures with Community Builder on Joomla 6. I have been able to reproduce the issue reliably and traced it down to CB's form-token validation.Reproducible scenario

1. User A is logged in.
2. User A logs out.
3. The login form is used to log in as User B.
4. Instead of logging in, Community Builder displays:

Session expired or cookies are not enabled in your browser. Please press "reload page" in your browser, and enable cookies in your browser.

The German translation is .The issue has been observed with Firefox on Windows. We also have a user for whom the problem occurs intermittently on two Windows computers, while login from Firefox on Android works.Clearing the site's cookies/session data temporarily appears to resolve the issue.What I foundThe failing request is: A successful login produces: I traced the failing request to , function .Before username/password authentication takes place, CB performs: This calls : For Joomla 6, CB ultimately delegates this to: So the failure occurs during CSRF token validation, before CB evaluates the supplied username or password.The token is present in the POSTI inspected the failed POST request in Firefox Developer Tools. The form does contain the Joomla/CB token, for example: along with the normal CB login fields ( , , , , username, password, etc.).CB generates this field using: with the token name supplied by Joomla and value .Therefore this does not appear to be a case where the browser simply omits the CSRF token. rejects a token that is present in the submitted form.Additional observationIn another occurrence we saw the following sequence: The first POST had actually authenticated the user successfully. Nevertheless, the subsequent POST resulted in the message. The user could see the error message while already being logged in ("Logout" was displayed in the site navigation).QuestionsCould this be a known issue with Community Builder's session/CSRF handling on Joomla 6, particularly after logout/session regeneration?Is there anything specific we should check regarding CB login forms and Joomla session regeneration after logout?I can reproduce the "User A logout → User B login → invalid token" case and can add temporary diagnostic logging if you need the expected token, submitted token and Joomla session ID for the GET/POST sequence.One additional minor issue: the current German translation still says that the session has expired or cookies are disabled, while the current English default string correctly describes the actual condition as an invalid security token. This made the issue initially look like a browser-cookie problem.

CB isn't responsible for form token validation. We simply call Joomla's API, add it to the form as a hidden input, then validate it on POST using Joomla's API. It routes through our middleware API to allow compatibility with multiple Joomla versions, but those immediately just call Joomla API.

You most likely have a caching issue of some kind. Are you using Joomla page caching or a 3rd party caching extension? Session regeneration should happen automatically by Joomla after the logout redirect. CB itself also calls Joomla's checkSession function to force a regeneration if you logged out through CB as a workaround for possible session regeneration issues. Not much more we can do there as CB doesn't manage the Joomla session.

translation still says that the session has expired or cookies are disabled, while the current English default string correctly describes the actual condition as an invalid security token. This made the issue initially look like a browser-cookie problem.

Translations are entirely a community driven effort. Sounds like that language string was never updated. You can fix it using language overrides shown below.

www.joomlapolis.com/blog/kyle/18701-language-overrides-have-arrived