CVE-2026-109312 in Grav Login Plugin
Summary
by MITRE • 10/12/2026
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The Grav Login plugin, specifically versions prior to 3.9.9 in its 2.7.0 release line, contains a critical authentication bypass vulnerability within the processUserProfile function. This flaw stems from an incomplete implementation of multi-factor authentication (MFA) state validation during user profile updates. The system correctly verifies that a session user exists and is authenticated via primary credentials such as a password. However, it fails to verify whether the two-factor authentication (2FA) challenge has been fully completed and authorized for the current session. This gap allows an attacker who possesses valid victim credentials to bypass the secondary security layer intended to protect account integrity.
The technical mechanism of this vulnerability relies on the sequence of operations during a profile update request. When a user submits data through a form that updates their own profile, the backend invokes processUserProfile(). The code checks for session existence but does not check if the pending 2FA state has transitioned from unverified to verified. Consequently, an attacker can submit a payload targeting the twofa_enabled field of the victim's account configuration before the browser-side or server-side logic enforces the completion of the second factor. By setting this flag to false, the attacker effectively disables two-factor authentication for that specific user account without needing to pass the 2FA challenge themselves.
The operational impact of this vulnerability is severe, leading directly to full account takeover and privilege escalation within the Grav CMS environment. Once an attacker successfully disables twofa_enabled using a valid password but incomplete MFA session, they retain persistent access even if the victim changes their password or enables other security measures later, unless explicitly re-enabled by an administrator. This bypass undermines the fundamental purpose of multi-factor authentication, which is to add a layer of defense beyond simple knowledge-based credentials. It allows attackers who have obtained passwords through phishing, credential stuffing, or data breaches to maintain long-term unauthorized access and potentially escalate privileges if the victim holds administrative roles within the CMS.
This vulnerability aligns with CWE-287, Improper Authentication, as the system fails to properly verify that all required authentication factors are present before granting access to sensitive functionality. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of persistence and privilege escalation through credential manipulation. The flaw represents a logic error where security controls are applied inconsistently across different endpoints or actions within the same application flow.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Administrators running Grav CMS should upgrade the Login plugin to version 3.9.9 or later, where this session state validation has been corrected to ensure that profile modifications require a fully authorized MFA session. In environments where upgrading is not immediately feasible, temporary mitigations include restricting access to user-facing forms through IP whitelisting if applicable, enforcing strong password policies to reduce the risk of initial credential compromise, and monitoring for unusual account configuration changes such as sudden disabling of 2FA settings. Regular audits of authentication logs can help detect attempts to exploit this logic flaw by identifying profile updates that occur without corresponding successful MFA completion events in the session history.