TYPO3 Core

This issue is not patched already in TYPO3 4.5.39 (i don't know, if it has been patched in newer major versions).

File t3lib/class.t3lib_userauth.php had to be changed like this (line 1298-1299):

$authInfo['db_user']['checkPidList'] = $this->checkPid ? $this->checkPid_value : '';
$authInfo['db_user']['check_pid_clause'] = $this->checkPid ? ' AND pid IN (' . $GLOBALS['TYPO3_DB']->cleanIntList($authInfo['db_user']['checkPidList']) . ')' : '';

if ($this->checkPid && ($this->checkPid_value || $this->checkPid_value === '0')) {
    $authInfo['db_user']['checkPidList'] = $this->checkPid_value;
    $authInfo['db_user']['check_pid_clause'] = ' AND pid IN (' . $GLOBALS['TYPO3_DB']->cleanIntList($authInfo['db_user']['checkPidList']) . ')';
} else {
    $authInfo['db_user']['checkPidList'] = '';
    $authInfo['db_user']['check_pid_clause'] = '';
}