CVE-2026-109312: falha de alta gravidade em getgrav grav-plugin-login
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.4%
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
getgrav · grav-plugin-loginCVEs relacionadas — getgrav grav-plugin-login
No mesmo produto, das mais perigosas para as menos.
CVE-2026-62669HIGHGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengeEPSS 0.5%CVE-2026-109313HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me CookieEPSS 0.4%CVE-2026-109314HIGHGrav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset PageEPSS 0.3%CVE-2026-114658HIGHGrav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.inviteEPSS 0.3%CVE-2026-72699CRITICALGrav Login Plugin before 3.9.1 Email Enumeration via RegistrationEPSS 0.3%CVE-2026-62671MEDIUMCSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)EPSS 0.2%