Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109321Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

Critical 9.1

In plain English

A critical-severity security flaw in grav-plugin-login-oauth from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav-plugin-login-oauth	1.0.0-beta.1 – before 1.4.3

Weakness: CWE-1391 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-mj8v-hvf6-73gm) vendor-advisory, third-party-advisory
VulnCheck Advisory: Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass third-party-advisory