Grav Login Plugin EUVD-2026-97615

Exploitation requires the attacker to already possess a valid account password (the first authentication factor) for a Grav instance running the Login plugin with two-factor authentication enabled and the remember-me feature active. The specific prerequisite is capturing the persistent remember-me cookie issued after the password step and restoring it before completing the second factor. Limiting factors: the attacker must have valid credentials (PR:L, not a pre-auth break), 2FA must be enabled (otherwise there is nothing to bypass), and only the affected version range 2.7.0 through before 3.9.9 is vulnerable; no victim user interaction is required.

This is a genuine elevated-priority issue for environments running the Grav Login plugin, though not a mass-exploitation emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality and integrity impact - consistent with the description, since the attacker must already possess a valid password (PR:L) and the payoff is a fully authorized session that defeats the 2FA control. No EPSS score was provided in the input, and the vulnerability is NOT in CISA KEV and has no referenced public exploit, so there is no evidence of active exploitation or widespread automated attack at this time. The signals are internally consistent (PR:L matches the 'attackers with a valid password' precondition), so there is no vector-versus-description conflict. The practical risk is bounded by the precondition that the attacker already holds a valid first-factor credential - meaning the real-world threat is to accounts whose passwords have leaked, been phished, or been reused, precisely the population 2FA is meant to protect; this makes it a meaningful defense-in-depth failure rather than a fully pre-authentication breach.

An attacker who has already obtained a victim's valid Grav password (via phishing, credential reuse, or a prior breach) submits the password to reach the 2FA step, captures the persistent remember-me cookie issued at that stage, and replays/restores it to obtain a fully authorized session without ever supplying the second factor. No public exploit code is referenced, so the attack would require original tooling, but the mechanism is straightforward given the described cookie-restoration flaw.