Filtered by vendor Getgrav Subscriptions
Filtered by product Grav-plugin-login Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-114658 1 Getgrav 1 Grav-plugin-login 2026-10-28 8.8 High
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
CVE-2026-109312 1 Getgrav 1 Grav-plugin-login 2026-10-15 8.1 High
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
CVE-2026-109314 1 Getgrav 1 Grav-plugin-login 2026-10-13 7.3 High
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.
CVE-2026-109313 1 Getgrav 1 Grav-plugin-login 2026-10-13 8.1 High
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.