Authentication Bypass via Remember-Me Cookie in Grav Login Plugin

Executive Summary

The Grav Login plugin versions before 3.9.9 have an authentication bypass flaw. Attackers with a valid password can skip two-factor authentication by exploiting a vulnerability in the remember-me cookie restoration process. They obtain a persistent remember-me cookie after the password step and restore it to gain full authorized access without completing the second authentication factor.

Useful 0 Not Useful 0

Detection Guidance

Check Grav Login plugin versions between 2.7.0 and 3.9.8. Look for unusual remember-me cookies being restored without completing 2FA. Inspect server logs for sessions established with only password authentication despite 2FA being enabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to bypass two-factor authentication and gain full access to user accounts if they know the password. This could lead to data breaches, unauthorized data access, or account takeover, depending on the privileges of the compromised account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from this security flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Grav Login plugin to version 3.9.9 or later to address the authentication bypass vulnerability. Disable the remember-me feature if not required and review all active sessions for unauthorized access.

Useful 0 Not Useful 0