Grav Plugin Login Oauth
Monthly
Authentication bypass in the Grav Login OAuth plugin before 1.4.3 lets unauthenticated remote attackers derive valid credentials for OAuth-provisioned accounts and take administrative control. The plugin assigns each auto-provisioned user a deterministic '<provider>.<id>' username and an unsalted MD5 hash of the provider identifier as the password, and it leaves password login enabled; anyone who learns or guesses the provider identifier can reproduce the login. No public exploit identified at time of analysis; the vendor-assigned CVSS 4.0 score is 9.3 Critical and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Authentication bypass in the Grav Login OAuth plugin before 1.4.3 lets unauthenticated remote attackers derive valid credentials for OAuth-provisioned accounts and take administrative control. The plugin assigns each auto-provisioned user a deterministic '<provider>.<id>' username and an unsalted MD5 hash of the provider identifier as the password, and it leaves password login enabled; anyone who learns or guesses the provider identifier can reproduce the login. No public exploit identified at time of analysis; the vendor-assigned CVSS 4.0 score is 9.3 Critical and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.