Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109313Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

High 8.1

In plain English

A high-severity improper authentication in grav-plugin-login from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav-plugin-login	2.7.0 – before 3.9.9

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-cmg5-qw8p-gxcf) vendor-advisory, third-party-advisory
VulnCheck Advisory: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie third-party-advisory