CVE-2026-109321 in Login OAuth
Summary
by MITRE • 10/12/2026
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Grav Login OAuth plugin prior to version 1.4.3 contains a critical authentication bypass vulnerability that stems from insecure credential management practices during the account provisioning process. When an unauthenticated user attempts to authenticate via an external identity provider such as Google, GitHub, or Facebook, the plugin creates a corresponding local Grav user account if one does not already exist. The flaw lies in how these newly provisioned accounts are configured for password-based authentication. Instead of disabling local login capabilities entirely for OAuth-only users, the system retains the ability to log in using traditional username and password credentials. Furthermore, it assigns a deterministic username constructed from the provider identifier and user ID, paired with an unsalted MD5 hash of that same provider identifier as the password. This design choice fundamentally undermines the security model by allowing attackers who know or can guess the external identity details to replicate local login credentials without needing access to the OAuth flow itself.
From a technical perspective, this vulnerability exploits weaknesses in both hashing algorithms and account lifecycle management. The use of MD5 for password storage is inherently problematic due to its susceptibility to collision attacks and rapid brute-forcing capabilities given modern computational power. More critically, the deterministic nature of the generated credentials means that if an attacker can identify the provider identifier associated with a target user, they can compute the exact hash used as the local password. Since many providers use predictable or publicly discoverable identifiers for common services, this information is often trivial to obtain through reconnaissance or social engineering. The combination of unsalted hashing and deterministic generation effectively turns external identity metadata into valid local authentication secrets, bypassing multi-factor protections that might otherwise be enforced by the OAuth provider itself.
The operational impact of this vulnerability is severe, particularly in environments where Grav instances are used for administrative purposes or host sensitive data. An unauthenticated remote attacker can exploit this flaw to gain unauthorized access to privileged accounts, including administrators who have linked their external identities to high-privilege local roles. Once authenticated via the compromised password mechanism, the attacker assumes full control over the account, potentially leading to complete system compromise, data exfiltration, or defacement of the web application. This is especially dangerous because it allows attackers to bypass any additional security layers that might be in place for OAuth logins, such as session timeouts or IP restrictions, by simply using standard HTTP basic authentication or form-based login interfaces which are often less monitored than dedicated OAuth endpoints.
This vulnerability aligns with CWE-798: Use of Hard-coded Credentials and CWE-320: Key Establishment Without Cryptographic Protection, as it involves the use of predictable values derived from public information for secure access. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1078: Valid Accounts, where attackers leverage legitimate credentials obtained through improper provisioning practices rather than exploiting a software bug in the traditional sense. The attack vector is classified under Remote Code Execution via Authentication Bypass, specifically leveraging weak password storage and identity management flaws.
To mitigate this risk, organizations must immediately upgrade to Grav Login OAuth plugin version 1.4.3 or later, where these insecure provisioning behaviors have been addressed. In addition to upgrading, administrators should audit existing user accounts for any that were created through OAuth integration before the patch was applied. It is recommended to disable local password login capabilities entirely for users who primarily authenticate via external providers by configuring appropriate plugin settings if available in newer versions. Furthermore, implementing multi-factor authentication at the application level can provide an additional layer of security even if credential compromise occurs. Regularly reviewing and rotating any remaining static credentials and ensuring that no deterministic hashes are used for sensitive access controls will further reduce exposure to similar attacks across other systems.