Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
CVE-2026-109312
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-109312
grav-plugin-login
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/getgrav/grav-plugin-login",
"vendor": "getgrav",
"product": "grav-plugin-login",
"versions": [
{
"status": "affected",
"version": "2.7.0",
"lessThan": "3.9.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.9.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-109312
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28492 · Revision 1
- Added to Heist Feed
- Publisher date