CVE-2026-66400

Received Received - Intake

Insufficient Session Expiration in Grav Login Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: VulnCheck

Description

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-66400

Affected Vendors & Products

Vendor	Product	Version / Range
grav	login_plugin	to 3.8.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

The Grav Login Plugin before version 3.8.13 has an insufficient session expiration flaw in the TokenStorage.php file. The findTriplet() method fails to validate Remember Me token timestamps properly. This allows attackers with a stolen Remember Me cookie to bypass session expiration and maintain indefinite access.

Detection Guidance

Check Grav Login Plugin version with: grep -r "login_plugin" /path/to/grav/install. If version is before 3.8.13, it is vulnerable. Inspect Remember Me token handling in TokenStorage.php for improper timestamp validation in findTriplet().

Impact Analysis

If you use the vulnerable Grav Login Plugin, attackers could exploit this to gain persistent unauthorized access to your account even after session timeouts. This could lead to data theft, unauthorized actions, or further compromise of your system.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely session termination and access controls, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Failure to address it may result in non-compliance penalties.

Mitigation Strategies

Upgrade Grav Login Plugin to version 3.8.13 or later immediately. Review and rotate all Remember Me tokens if compromised. Monitor authentication logs for unusual activity.

Hi! I’m here to help you understand CVE-2026-66400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70