Grav Login Plugin EUVD-2026-87761

Requires (1) a Grav site running grav-plugin-login 3.8.7-3.9.6 with two-factor authentication enabled, (2) content gated specifically by the no-argument authenticated() Twig function, the group form authenticated(null, 'group'), or the [authenticated] shortcode (the inverse [guest] shortcode is likewise mis-evaluated), and (3) the attacker must already know a target member's password - the whole point is bypassing only the second factor. Limiting factors: exploitation yields no completed session and cannot reach access:-rule-protected pages or let the attacker act as the user; the authenticated('some.permission') form via UserObject::authorize() is not affected; impact is confined to disclosure of that gated content.

This is a genuine but low-severity flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N = 6.9) marks it network-reachable, low-complexity, and nominally unauthenticated, but that PR:N is misleading in practice: the description states the attacker must already know a valid member's password - they simply cannot answer the second factor. So real-world exploitation is gated by prior credential compromise, which is a meaningful barrier the score does not capture. Impact is strictly confidentiality-limited (VC:L): the attacker reads content gated by the no-argument authenticated() Twig function / [authenticated] shortcode, but obtains no completed session, cannot reach access:-rule-protected pages, and cannot act as the user. There is no integrity or availability impact, and the authenticated('some.permission') form routed through UserObject::authorize() is unaffected. No EPSS score, no CISA KEV listing, and no POC are present in the input - consistent with a niche CMS plugin flaw of limited blast radius. Signals align rather than conflict: modest CVSS, no exploitation evidence, narrow impact. This is a patch-in-normal-cycle issue, not an emergency; the PR:N vs. password-precondition tension is the main caveat to verify.

An attacker who has already obtained a Grav member's password (e.g., via phishing or reuse) submits it to a 2FA-enabled Grav site and stops at the 2FA code prompt without answering it. Because Login::isAuthenticated() only checked the password-step session flag, that half-completed session is treated as authenticated, letting the attacker load pages whose content is gated by authenticated() or [authenticated] and read member-only material. No public exploit code is identified at time of analysis.