{"schema":"threatline.record/2","record":{"id":"CVE-2026-100667","aliases":["GHSA-636m-8598-45r9"],"summary":"grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass","details":"grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.","categories":["Unclassified"],"product":"grav","vendor":"getgrav","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100667","source_modified_at":"2026-09-28T18:14:51.902Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"grav","vendor":"getgrav","versions":[{"version":"3.8.7","status":"affected","versionType":"semver","lessThan":"3.9.7"},{"version":"3.9.7","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100667","source_modified_at":"2026-09-28T18:14:51.902Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"grav","ecosystem":null},"version":"3.9.7","basis":"first unaffected version stated in the CVE record"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00307,"percentile":0.22363,"score_date":"2026-10-23"},"published_at":"2026-09-26T13:23:32.685Z","modified_at":"2026-09-28T18:14:51.902Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100667","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-28T18:14:51.902Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100667","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/getgrav/grav/security/advisories/GHSA-636m-8598-45r9","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/grav-plugin-login-3.8.7-through-3.9.6-two-factor-authentication-bypass","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-28T18:12:38.035267Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T18:14:51.902Z","content_hash":"0467aad910c3fee3d48f09fc4d1cf4f3c54501a8af921d530b2bb3ecac87e089"}}