Authentication Bypass Vulnerability in Grav Login Plugin by Grav

CVE-2026-109313

What is CVE-2026-109313?

The Grav Login plugin prior to version 3.9.9 is susceptible to an authentication bypass flaw. This vulnerability allows attackers with a valid password to circumvent two-factor authentication measures by leveraging the restoration of a persistent remember-me cookie. Once an attacker acquires this cookie after the password verification step, they can gain access to a fully authorized session without necessitating the completion of the second authentication factor, thereby increasing the risk of unauthorized account access.

References