CVE-2026-109313GHSA-cmg5-qw8p-gxcf
grav-plugin-login: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
getgrav grav-plugin-login
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.9.9grav-plugin-loginCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.
Text from CVE List
Affected versions 2
- grav-plugin-loginaffected: 2.7.0 before 3.9.9CVE List
- grav-plugin-loginunaffected: 3.9.9CVE List