Grav Login Plugin EUVD-2026-65214

A valid username on the target Grav installation must be known or guessable (usernames may be discoverable through registration flows or public author pages). The password reset or account activation feature must be enabled and reachable - this is the default configuration in standard Grav deployments. The taskReset endpoint must accept repeated unauthenticated POST submissions without rate limiting, which is the out-of-box Grav state. Critically, the attacker must achieve sufficiently low and stable network round-trip times to resolve sub-millisecond timing differences between token comparisons; this requires either a low-latency path to the target (co-located infrastructure, same hosting region, or LAN access) or a very high request volume with statistical aggregation. Remote internet-path jitter is the primary practical constraint limiting exploitation beyond the raw CVSS assessment. No privileged access, user interaction, or non-default application feature is required beyond accessible password reset functionality.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) represents an upper-bound theoretical assessment; the vendor's own characterization of practical exploitability as low, combined with the inherent noise of network-layer timing measurements, substantially reduces realistic risk below what the score implies. The absence of rate limiting is the most consequential amplifier - even a mid-sized municipal IT team in malbork running a public-facing Grav instance would be exposed to sustained high-volume enumeration attempts that a WAF or server-level rate limit could easily block. No EPSS data was provided in the intelligence package, and the vulnerability is absent from CISA KEV, confirming no observed active exploitation. SSVC routing for most operators with no specific threat intelligence would reach 'scheduled' remediation rather than emergency response. The primary real-world risk vector is an attacker with a stable, low-latency network path to the target - co-located hosting environments or cloud instances near the target are the realistic threat scenarios.

An attacker who knows a valid Grav username initiates a password reset for that account, gaining access to the unauthenticated taskReset submission endpoint. The attacker then dispatches thousands of HTTP POST requests with candidate token values, timing the server's === comparison responses byte-by-byte to progressively narrow the token space through the timing oracle; because no rate limiting is enforced, the enumeration volume needed is unconstrained. No publicly available proof-of-concept code demonstrating this end-to-end attack chain has been identified.