CVE-2026-66400 Details
Description
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.
A vulnerability exists in the Grav Login Plugin in versions prior to 3.8.13, where the session expiration for 'Remember Me' tokens is not properly enforced. The issue arises in the TokenStorage.php file, specifically within the findTriplet() method, which incorrectly validates token timestamps. This flaw allows attackers with a intercepted 'Remember Me' cookie to authenticate indefinitely, bypassing the intended timeout period. The vulnerability stems from the expiry check comparing an array to a scalar value, leading to a perpetual acceptance of valid token pairs until the associated user data is overwritten or cleared.
Users are advised to update the Grav Login Plugin to version 3.8.13 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-login-plugin-before-insufficient-session-expiration | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Login Plugin | <= 3.8.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |