CVE-2026-109313 Details

An authentication bypass vulnerability has been identified in the Grav Login plugin, specifically in versions 2.7.0 prior to 3.9.9. This vulnerability allows attackers with a valid password to bypass two-factor authentication (2FA) by exploiting the remember-me cookie functionality. After successfully entering a password, an attacker can obtain a persistent remember-me cookie and use it to restore a fully authorized session, effectively skipping the 2FA requirement. The issue arises because the remember-me cookie is issued without verifying whether the 2FA challenge has been completed, allowing for unauthorized access to accounts that rely on this security measure.

Users are advised to update to Grav Login plugin version 3.9.9 or later, where this vulnerability has been patched.