Grav Login Plugin Authorization and Timing Flaws

Email address enumeration in the Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 lets unauthenticated remote attackers determine which email addresses are registered on a Grav CMS site. The register() method returns a distinct EMAIL_NOT_AVAILABLE error for already-registered addresses while proceeding normally otherwise, and because the registration endpoint enforces no rate limiting, an attacker can test addresses at scale, one per request. No public exploit identified at time of analysis; the assigned CVSS 4.0 score of 9.3 appears substantially inflated for what is fundamentally an information-disclosure weakness.

Broken authorization in the Grav Login plugin before 1.0.16 lets an operator holding the api.users.write permission clear login lockout counters on admin.super accounts through the onApiUserListRowAction unlock handler, which never checks the target account's privilege tier. This strips brute-force protection from the highest-privilege accounts, enabling a lower-privileged user to set up password-guessing against super-admin credentials. Reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.

Password reset and account activation token comparison in Grav Login Plugin before 3.9.1 uses PHP's non-constant-time === operator instead of hash_equals(), exposing a CWE-208 timing oracle in both taskReset() (classes/Controller.php) and the activation handler (login.php). Combined with the absence of rate limiting on the token-submission endpoint, an unauthenticated network attacker can submit high-volume repeated token guesses against a known username and statistically recover a valid reset token via timing discrepancy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor itself characterizes practical exploitability as low, and no end-to-end network exploitation has been demonstrated.