CVE-2026-109312
Received Received - Intake

Authentication Bypass in Grav Login Plugin via 2FA Session Manipulation

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109312
EUVD
EUVD-2026-97614

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-login 2.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Grav Login plugin versions before 3.9.9 have an authentication bypass flaw in the processUserProfile() function. This flaw allows attackers with a victim's password to bypass two-factor authentication (2FA) by publishing a page form without proper access rules. They can then invoke update_user to disable 2FA and take over the account.

Detection Guidance

Check Grav Login plugin versions. Run: grep -r 'grav-plugin-login' /path/to/grav/install. Versions before 3.9.9 are vulnerable.

Impact Analysis

If you use the vulnerable Grav Login plugin, attackers could gain unauthorized access to your account by exploiting this flaw. They only need your password and the ability to publish a page form without access rules. This could lead to data theft, account takeover, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using this plugin may face compliance failures, legal penalties, or reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Grav Login plugin to version 3.9.9 or later immediately. Disable front-end forms if not needed. Review user accounts for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart