CVE-2026-100667 grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...