CVE-2026-100667
Deferred Deferred - Pending Action

Two-Factor Authentication Bypass in Grav CMS Login Plugin

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100667
EUVD
EUVD-2026-87761

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
grav grav-plugin-login to 3.9.7 (inc)
getgrav grav-plugin-login From 3.8.7 (inc) to 3.9.7 (exc)
getgrav grav-plugin-login 3.9.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-304 The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in grav-plugin-login versions 3.8.7 to 3.9.6 allows bypassing two-factor authentication (2FA) for Grav CMS. The plugin incorrectly checks only if the password step was completed, not the full 2FA process. This lets an attacker with a user's password but no access to their 2FA method view member-only content protected by the authenticated() function or [authenticated] shortcode.

Detection Guidance

Check the installed version of grav-plugin-login. If it is between 3.8.7 and 3.9.6, the system is vulnerable. Use commands like 'composer show grav-plugin-login' or check the plugin directory in Grav CMS.

Impact Analysis

An attacker who knows a user's password but cannot bypass 2FA can access restricted content. The impact is limited to content disclosure; they cannot gain full session access, bypass stricter access rules, or perform actions as the user.

Mitigation Strategies
  • Upgrade grav-plugin-login to version 3.9.7 or later immediately.
  • Replace affected [authenticated] shortcodes with page-level access rules as a temporary workaround.
  • Review and restrict access to member-only content until the plugin is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart