Grav Login Plugin CVE-2026-53654

Exploitation requires that the Grav Login plugin (grav-plugin-login) be installed and active on the target site - it is a standard plugin but must be enabled. The twofa_cancel task endpoint must be reachable over the network; no authentication is required (PR:N). The attacker must control or influence the _redirect POST parameter to point to an external http, https, or protocol-relative URL. Exploitation is limited by user interaction: a victim must follow or submit to the crafted request (UI:P in CVSS 4.0), making this a phishing-dependent attack rather than a directly exploitable server flaw. There is no code execution, no data exfiltration from the Grav server, and no availability impact - the harm is entirely to the victim's trust relationship. Non-default configurations do not expand the attack surface; the vulnerability exists in default Login plugin behavior.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) accurately reflects the real-world risk profile: the attack is trivially launched over the network with no authentication and no special conditions, but requires passive user interaction - a victim must click or follow a crafted link. This shifts the threat model firmly into phishing territory rather than direct system compromise. EPSS data was not provided in the source intelligence; the absence of KEV listing and public exploit code suggests this has not been observed in broad exploitation campaigns. The subsequent-system impact metrics (SC:L/SI:L) in the CVSS 4.0 vector correctly capture that the Grav server itself is unaffected - the integrity harm is to the victim's trust relationship and browsing session. Despite the moderate score, even a mid-sized municipal IT team in inowroclaw running a public-facing Grav instance should treat patching as a near-term priority, since the unauthenticated attack surface means no internal access is required and brand or institutional trust can be abused at scale via mass-distributed phishing URLs. The data is internally consistent: no conflicting signals between CVSS vector and description.

An attacker crafts a POST request URL targeting a trusted Grav site's twofa_cancel endpoint and includes a _redirect parameter pointing to an attacker-controlled phishing domain, then distributes this link via email or social engineering. A victim who clicks the link is transparently redirected by the legitimate Grav host to the malicious site, lending the phishing page the credibility of originating from a trusted domain. No public exploit code has been identified, but the attack is trivially reproducible from the CVE description alone given its low technical complexity.