CVE-2026-62671

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

EUVD-2026-62544

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

EUVD-2026-62540

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-66400

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

CVE-2026-66400 Grav Login Plugin before 3.8.13 Insufficient Session Expiration

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

CVE-2026-66400 Grav Login Plugin before 3.8.13 Insufficient Session Expiration

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

EUVD-2026-50324

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

CVE-2026-66400

Grav Login Plugin = 3.8.13 or follow vendor advisories cited in the references to mitigate.

CVE-2026-65603

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

EUVD-2026-47647

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

CVE-2026-65603 Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

PT-2026-63361

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the update user task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from...