Is there a patch available for CVE-2026-66400?

Yes, a patch is available for CVE-2026-66400. Update the affected software to the latest version immediately.

Grav Login Plugin CVE-2026-66400

Q: What is the CVSS score of CVE-2026-66400?

CVE-2026-66400 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50324 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-07-29 VulnCheck

GHSA-x4cg-fxgx-67gm

PHP Information Disclosure Grav Getgrav

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Requires prior cookie capture raising AC:H; no privileges needed to replay token; limited confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 29, 2026 - 15:02 EUVD

Analysis Generated

Jul 29, 2026 - 14:25 vuln.today

DescriptionCVE.org

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

AnalysisAI

Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.

Technical ContextAI

Grav is a flat-file PHP CMS (CPE: cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*) that implements Remember Me authentication via a TokenStorage class in its Login Plugin. The vulnerability is rooted in CWE-613 (Insufficient Session Expiration): the findTriplet() method in TokenStorage.php retrieves a stored token structure and attempts to validate the timestamp against the configured expiry window, but due to PHP's type juggling behavior, comparing an array (the stored token structure) to a scalar (a Unix timestamp or integer) produces an unexpected boolean result that never correctly identifies the token as expired. This means every Remember Me token issued becomes permanently valid regardless of the site's configured session duration. The flaw is in the plugin layer, not Grav core, but the CPE string maps to the parent getgrav:grav product.

RemediationAI

Upgrade the Grav Login Plugin to version 3.8.13 or later, which corrects the array-to-scalar type comparison in TokenStorage.php's findTriplet() method. Vendor details are published at the GitHub advisory GHSA-mj78-8gwc-vxjj. If immediate patching is not possible, a targeted workaround is to disable the Remember Me feature entirely in Grav's Login Plugin configuration, which eliminates the vulnerable code path at the cost of requiring users to re-authenticate on every session. Additionally, invalidating all existing Remember Me tokens by rotating the application's session secret will render any previously captured cookies useless. Sites running over HTTP should treat this as a higher priority given that cookies could be intercepted in transit; enforcing HTTPS with Secure cookie flags limits the exposure surface for token capture.