Grav Plugin Login
Monthly
Privilege escalation in the Grav Login plugin (3.6.0 before 3.9.13) allows page authors to obtain super-user accounts by defining an invitation form in page frontmatter and submitting the login.invite task without authentication. The missing authorization check requires an existing authenticated page-author foothold (PR:L) to plant the invitation form, so it is not exploitable by a fully anonymous outsider; no public exploit code or CISA KEV entry was identified at time of analysis. This is a credible, actionable privilege-escalation issue rather than a drop-everything remote-root flaw.
Password-reset token disclosure in the Grav Login plugin (versions 1.2.0 up to but not including 3.9.9) allows any user holding a publisher-level account to hijack more privileged accounts. A publisher authors a page at the plugin's password-reset route so that Login::getPage() renders attacker-controlled content on that route; when a higher-privileged victim opens an emailed reset link, the rendered page exposes the victim's username and bearer reset token, which the attacker can redeem to take over the account. Exploitation requires an existing publisher account plus victim interaction (clicking the emailed reset link), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Two-factor authentication bypass in the Grav Login plugin versions 2.7.0 through before 3.9.9 allows an authenticated remote attacker who already possesses a valid password to restore a remember-me cookie issued after the password step and obtain a fully authorized session without completing the second factor, yielding high confidentiality and integrity impact. This is a genuine elevated-priority issue for environments using the plugin with 2FA and remember-me enabled, though not a mass-exploitation emergency; no public exploit identified at time of analysis.
Authentication bypass in Grav Login plugin versions 2.7.0 before 3.9.9 allows attackers who already know a victim's password to disable two-factor authentication (2FA) and take over the account by invoking the update_user task through a published page form without an access rule. The flaw resides in processUserProfile(), which verifies that a session user exists but fails to confirm that a pending front-end 2FA session is fully authorized. Exploitation requires three conditions: the attacker must possess the victim's password, have an in-progress front-end login that has reached the 2FA step, and be able to publish a Grav page form lacking an access rule; no public exploit has been identified at time of analysis.
Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack primitive is explicitly confirmed by vendor advisory GHSA-7mgc-c7pq-3rr3 and the commit diff.
Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.
Privilege escalation in the Grav Login plugin (3.6.0 before 3.9.13) allows page authors to obtain super-user accounts by defining an invitation form in page frontmatter and submitting the login.invite task without authentication. The missing authorization check requires an existing authenticated page-author foothold (PR:L) to plant the invitation form, so it is not exploitable by a fully anonymous outsider; no public exploit code or CISA KEV entry was identified at time of analysis. This is a credible, actionable privilege-escalation issue rather than a drop-everything remote-root flaw.
Password-reset token disclosure in the Grav Login plugin (versions 1.2.0 up to but not including 3.9.9) allows any user holding a publisher-level account to hijack more privileged accounts. A publisher authors a page at the plugin's password-reset route so that Login::getPage() renders attacker-controlled content on that route; when a higher-privileged victim opens an emailed reset link, the rendered page exposes the victim's username and bearer reset token, which the attacker can redeem to take over the account. Exploitation requires an existing publisher account plus victim interaction (clicking the emailed reset link), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Two-factor authentication bypass in the Grav Login plugin versions 2.7.0 through before 3.9.9 allows an authenticated remote attacker who already possesses a valid password to restore a remember-me cookie issued after the password step and obtain a fully authorized session without completing the second factor, yielding high confidentiality and integrity impact. This is a genuine elevated-priority issue for environments using the plugin with 2FA and remember-me enabled, though not a mass-exploitation emergency; no public exploit identified at time of analysis.
Authentication bypass in Grav Login plugin versions 2.7.0 before 3.9.9 allows attackers who already know a victim's password to disable two-factor authentication (2FA) and take over the account by invoking the update_user task through a published page form without an access rule. The flaw resides in processUserProfile(), which verifies that a session user exists but fails to confirm that a pending front-end 2FA session is fully authorized. Exploitation requires three conditions: the attacker must possess the victim's password, have an in-progress front-end login that has reached the 2FA step, and be able to publish a Grav page form lacking an access rule; no public exploit has been identified at time of analysis.
Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack primitive is explicitly confirmed by vendor advisory GHSA-7mgc-c7pq-3rr3 and the commit diff.
Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.