CVE-2026-109312 Details
Description
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
An authentication bypass vulnerability has been identified in the Grav Login plugin versions 2.7.0 prior to 3.9.9. The issue arises in the 'processUserProfile()' function, which verifies the existence of a session user but fails to ensure that a pending front-end two-factor authentication (2FA) session is fully authorized. This flaw allows attackers with knowledge of a victim's password, and the ability to publish an unprotected page form, to invoke the 'update_user' action before completing the 2FA process. As a result, they can disable the 'twofa_enabled' feature and take over the victim's account.
Users are advised to update to Grav Login plugin version 3.9.9 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Login | <= 3.9.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |