Authentication Bypass Vulnerability in Grav Login Plugin by Grav

CVE-2026-109312

What is CVE-2026-109312?

The Grav Login plugin prior to version 3.9.9 has a vulnerability that allows attackers to bypass two-factor authentication (2FA) during user profile updates. Specifically, the flaw resides in the processUserProfile() function, which inadequately verifies if the pending front-end 2FA session has been fully authorized. If an attacker possesses a victim's password and can publish a page form without restrictions, they can invoke the update_user function before completing the 2FA process. This grants them the ability to disable the two-factor authentication feature and potentially take over the victim's account.

References