CVE-2026-109314 in Login Plugin
Summary
by MITRE • 10/12/2026
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The Grav CMS platform includes a user authentication plugin known as Grav Login, which manages user registration, login sessions, and password recovery workflows. In versions prior to 3.9.9, specifically affecting releases from 1.2.0 through the vulnerable range, there exists a critical information disclosure vulnerability within the password reset mechanism. This flaw stems from an improper handling of page rendering logic during the account recovery process. The vulnerability allows any registered user with publishing privileges on the Grav instance to exploit the reset route for unauthorized data exposure and subsequent account takeover attacks.
The technical root cause lies in how the Login plugin processes requests directed at the password reset endpoint. When a legitimate user initiates a password reset, the system generates a unique token and sends it via email along with a link containing that token. However, due to flawed logic within the getPage() method of the Login module, an attacker can craft a specific page structure or request path that mimics the expected behavior of the reset flow but is controlled by the publisher rather than the system's internal state machine. By authoring a page at the designated reset route, the attacker forces the application to render content in a context where sensitive session data and authentication credentials are inadvertently exposed.
This vulnerability facilitates an information disclosure attack that directly leads to privilege escalation and account takeover. When a victim user clicks on a maliciously crafted link or interacts with the compromised reset interface, the server-side logic fails to properly isolate the security tokens from public output. Consequently, the rendered page exposes both the username associated with the target account and the bearer token required for authentication. This exposure effectively bypasses the intended security controls of the password recovery process, as the attacker gains access to credentials that should remain confidential until verified through proper channels.
From a classification perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information and CWE-359: Exposure of Private Personal Information to an Unauthorized Actor. The attack vector is consistent with MITRE ATT&CK technique T1078: Valid Accounts, where the adversary leverages stolen or exposed credentials to gain unauthorized access. Furthermore, because the exploitation requires a user to interact with a link that reveals sensitive data, it also touches upon aspects of social engineering and phishing if used in conjunction with deceptive communication strategies designed to trick victims into triggering the exposure.
The operational impact of this flaw is severe for any Grav CMS deployment relying on its default or unpatched Login plugin configuration. Attackers can systematically enumerate valid usernames by observing responses from reset attempts, although the primary risk here is the direct theft of active session tokens and user identifiers. Once an attacker possesses a valid bearer token and username, they can authenticate as that user without needing to know their password. This capability allows for full account compromise, enabling the attacker to modify site content, access private data stored by users, or escalate privileges if the compromised account has administrative rights within the Grav environment.
Mitigation strategies must focus on immediate patching and configuration hardening. Administrators running affected versions of the Grav Login plugin should upgrade immediately to version 3.9.9 or later, where this logic flaw in getPage() has been corrected to ensure that sensitive tokens are never rendered in publicly accessible page content. Until patches can be applied, administrators may consider disabling the public-facing password reset feature if it is not strictly required for their use case, thereby removing the attack vector entirely. Additionally, implementing strict Content Security Policy headers and ensuring that error messages do not leak internal state details can provide a layer of defense-in-depth against similar information disclosure flaws in other components of the application stack.