Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109312Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

High 8.1

In plain English

A high-severity improper authentication in grav-plugin-login from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav-plugin-login	2.7.0 – before 3.9.9

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-5rph-jqcf-2x36) vendor-advisory, third-party-advisory
VulnCheck Advisory: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form third-party-advisory