CVE-2026-109312: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

Q: Who is realistically exposed to this bypass?

Sites using Grav Login Plugin versions from 2.7.0 before 3.9.9 are exposed if an attacker can publish a page form that lacks an access rule. The targeted account must have front-end two-factor authentication enabled.

Q: What does an attacker need to exploit the issue?

The attacker needs the victim's password and the ability to publish a page form without an access rule. No user interaction is required after those conditions are met.

Q: What can an attacker do after exploiting it?

The attacker can invoke update_user before completing the pending 2FA flow and disable the victim account's twofa_enabled setting. This allows takeover of the account.

Q: How can I tell whether my deployment is affected?

Check whether the Grav Login Plugin version is 2.7.0 or later but earlier than 3.9.9. Also determine whether users can publish page forms without access rules, as that capability is required for exploitation.

Published Oct 12, 2026

Updated

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke updateuser before completing 2FA to disable twofaenabled and take over the account.

Affected Software

1 affected component

Grav Login Plugin>=2.7.0<3.9.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav Login Plugin to a version that resolves this vulnerability.
Fixed in 3.9.9

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this bypass?

Sites using Grav Login Plugin versions from 2.7.0 before 3.9.9 are exposed if an attacker can publish a page form that lacks an access rule. The targeted account must have front-end two-factor authentication enabled.

What does an attacker need to exploit the issue?

The attacker needs the victim's password and the ability to publish a page form without an access rule. No user interaction is required after those conditions are met.

What can an attacker do after exploiting it?

The attacker can invoke update_user before completing the pending 2FA flow and disable the victim account's twofa_enabled setting. This allows takeover of the account.

How can I tell whether my deployment is affected?

Check whether the Grav Login Plugin version is 2.7.0 or later but earlier than 3.9.9. Also determine whether users can publish page forms without access rules, as that capability is required for exploitation.

CVE-2026-109312: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this bypass?

What does an attacker need to exploit the issue?

What can an attacker do after exploiting it?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this bypass?

What does an attacker need to exploit the issue?

What can an attacker do after exploiting it?

How can I tell whether my deployment is affected?