CVE-2026-109312: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke updateuser before completing 2FA to disable twofaenabled and take over the account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Login Pluginto a version that resolves this vulnerability.Fixed in 3.9.9
Event History
Frequently Asked Questions
Who is realistically exposed to this bypass?
Sites using Grav Login Plugin versions from 2.7.0 before 3.9.9 are exposed if an attacker can publish a page form that lacks an access rule. The targeted account must have front-end two-factor authentication enabled.
What does an attacker need to exploit the issue?
The attacker needs the victim's password and the ability to publish a page form without an access rule. No user interaction is required after those conditions are met.
What can an attacker do after exploiting it?
The attacker can invoke update_user before completing the pending 2FA flow and disable the victim account's twofa_enabled setting. This allows takeover of the account.
How can I tell whether my deployment is affected?
Check whether the Grav Login Plugin version is 2.7.0 or later but earlier than 3.9.9. Also determine whether users can publish page forms without access rules, as that capability is required for exploitation.