CVE-2026-100667 in Login Plugin
Summary
by MITRE • 09/26/2026
grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The Grav CMS Login plugin version 3.8.7 through 3.9.6 contains a critical logic flaw that undermines the effectiveness of two-factor authentication for specific content gating mechanisms. This vulnerability arises from an inconsistency in how the application determines user authentication status during different stages of the login process. Specifically, when sites have two-factor authentication enabled, the internal method Login::isAuthenticated() relies solely on checking whether the initial password verification step has succeeded. It fails to verify that the subsequent second factor challenge has also been completed and validated by the user. Consequently, a session that is merely paused at the point where it awaits the entry of a one-time code or other secondary credential is incorrectly classified as fully authenticated within certain contexts.
This architectural oversight allows an attacker who possesses valid credentials for a member account but lacks access to the second factor device to bypass security controls designed to restrict sensitive information. The primary impact is limited to the disclosure of content that is gated by the authenticated() Twig function or the [authenticated] shortcode, as well as its inverse, the [guest] shortcode which determines visibility based on guest status. Because these functions evaluate authentication state too early in the session lifecycle, they grant access to member-only pages and data even though the user has not fully completed the multi-factor login process. This represents a significant deviation from expected security behavior where two-factor authentication should be required for all protected resources unless explicitly exempted by policy.
The scope of this vulnerability is precisely defined by its interaction with specific API methods within the plugin. The authenticated() function and the group-authenticated(null, 'group') variant are affected because they rely on the flawed session flag check. In contrast, forms that utilize authenticated('some.permission') or similar permission-based checks invoke UserObject::authorize(), which correctly validates full authentication status including two-factor completion. Therefore, these specific pathways remain secure against this bypass technique. An attacker cannot use this flaw to obtain a fully completed session, nor can they access pages protected by standard access rules or perform actions on behalf of the user. The impact is strictly confined to unauthorized read-access to content that was intended to be visible only after full multi-factor verification.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the context of session management logic. It also relates to ATT&CK technique T1078 Valid Accounts, as it allows an adversary to leverage stolen credentials to access resources without completing all required authentication steps. The flaw highlights a common pitfall in web application development where partial state is treated equivalently to complete state for authorization decisions.
To mitigate this risk, organizations running Grav CMS must upgrade the Login plugin to version 3.9.7 or later immediately. This update corrects the logic within Login::isAuthenticated() to ensure that both password and second-factor steps are verified before granting access via the affected Twig functions and shortcodes. Until the patch is applied, administrators should consider implementing additional server-side checks or WAF rules if possible, though upgrading remains the only definitive solution. Regular auditing of authentication flows in custom plugins can help prevent similar logical errors where session state does not accurately reflect the completion of all required security challenges.