Information Disclosure Vulnerability in Grav Login Plugin by Grav

CVE-2026-109314

What is CVE-2026-109314?

The Grav Login Plugin versions prior to 3.9.9 exhibit a critical vulnerability that allows malicious publishers to disclose sensitive information. By crafting a page at the password-reset route, an attacker can obtain password-reset tokens. When a victim clicks on a reset link sent via email, the publisher's page, as rendered by Login::getPage(), can reveal the victim's username along with a bearer token, posing a risk of account takeover for higher-privileged accounts.

References