Two-Factor Authentication Bypass in Grav CMS Login Plugin by Grav

CVE-2026-100667

What is CVE-2026-100667?

The Grav CMS Login plugin versions 3.8.7 to 3.9.6 are vulnerable to a two-factor authentication bypass, allowing attackers who know a user’s password to access member-only content without providing the second factor of authentication. This vulnerability arises due to improper session handling during the two-factor authentication process, treating a session that is paused at the 2FA code prompt as fully authenticated. Although the attacker cannot complete the login or access pages protected by access rules, they can exploit this vulnerability to read content restricted to logged-in users through the authenticated() function or associated shortcodes. This issue has been addressed in version 3.9.7.

References