CVE-2026-109314
Received Received - Intake

Grav Login Plugin Information Disclosure Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109314
EUVD
EUVD-2026-97616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-login 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure flaw in the Grav Login plugin versions 1.2.0 through 3.9.8. Attackers with publisher access can create a page at the reset route. When a victim clicks a password-reset link, the attacker-controlled page exposes the username and bearer token, allowing takeover of privileged accounts.

Detection Guidance

Check Grav CMS installations for the Login plugin versions 1.2.0 through 3.9.8. Inspect server logs for unauthorized page creations at the reset route (/reset) and verify if publisher-authored pages are rendering sensitive reset tokens. No specific commands are provided in the context.

Impact Analysis

If you are a Grav CMS user with the vulnerable plugin, attackers could steal your password-reset tokens and gain access to your account. This could lead to unauthorized actions, data theft, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance penalties, and loss of trust in systems handling protected information.

Mitigation Strategies

Upgrade the Grav Login plugin to the latest patched version if available. Temporarily disable the plugin if no patch exists. Restrict publisher permissions to prevent unauthorized page creation. Monitor for suspicious reset token exposure in server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart