Authentication Bypass in Grav Login Plugin by Grav
CVE-2026-42613

9.4CRITICAL

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
11 May 2026

What is CVE-2026-42613?

The Grav Login plugin, prior to version 2.0.0-beta.2, enables an unauthenticated user to gain admin.super privileges through an insecure registration process. The 'Login::register()' method does not properly validate the groups and access fields specified in the registration POST data. If an attacker manipulates these fields to match those in the allowed fields list, they can self-register with elevated privileges. This poses significant security risks as it can allow unauthorized access to sensitive areas of the web application. The vulnerability has been addressed in version 2.0.0-beta.2.

Affected Version(s)

grav < 2.0.0-beta.2

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-login/commit/3d419...
x_refsource_MISC

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.