Grav Login Plugin CVE-2026-66400

Exploitation requires two specific preconditions: first, the target Grav site must have the Remember Me feature enabled in the Login Plugin (this is a configurable option, not the default in all deployments); second, the attacker must already possess a valid Remember Me cookie captured from an authenticated user via a separate attack vector such as XSS, network interception, or physical access. Without a previously obtained token, this vulnerability cannot be exploited remotely. Exploitation is limited to whatever CMS access level the hijacked account holds - it does not provide privilege escalation beyond the victim's role. Grav sites running over HTTPS with HttpOnly and Secure cookie flags materially reduce the token capture risk, though they do not fix the underlying expiry bypass.

The CVSS 4.0 score of 6.3 reflects a moderate-severity vulnerability with meaningful real-world constraints. AV:N confirms network-accessible exploitation, but AC:H and AT:P together indicate that successful exploitation requires specific preconditions - most critically, the attacker must already possess a valid Remember Me cookie obtained through a prior compromise vector (e.g., session hijacking, XSS-based cookie theft, network interception over HTTP). This is not a vulnerability that enables initial access; it amplifies the persistence value of a stolen credential. EPSS data is not provided in the source intelligence. No CISA KEV listing means active exploitation is not confirmed. The limited impact metrics (VC:L/VI:L/VA:N) suggest the blast radius is bounded by the privilege level of the hijacked account. The core risk is that defenders relying on session timeout as a compensating control for a compromised Remember Me token will find that control is entirely non-functional on unpatched instances.

An attacker who previously obtained a victim's Grav Remember Me cookie - via a network sniff on an HTTP-only deployment, a prior XSS attack, or physical access to a browser - replays that cookie against the Grav login endpoint after the configured timeout period has elapsed. Because the timestamp expiry check in findTriplet() always evaluates incorrectly due to the PHP type comparison bug, the server accepts the stale token and issues an authenticated session, granting the attacker persistent access to the Grav CMS backend for as long as the token record exists in storage.