CVE-2026-109313: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Grav Login Plugin versions from 2.7.0 up to, but not including, 3.9.9 are affected. The issue concerns configurations where two-factor authentication and remember-me cookie functionality are used.
What does an attacker need to bypass two-factor authentication?
An attacker needs a valid account password. After completing the password step, they can obtain a persistent remember-me cookie and restore it as a fully authorized session without supplying the second factor.
Does this allow unauthenticated account access?
No. The described attack requires a valid password for the target account; it bypasses the second authentication factor rather than the password requirement.
How can I determine whether a system may be vulnerable?
Check the installed Grav Login Plugin version. Versions earlier than 3.9.9, starting with 2.7.0, may permit remember-me cookie restoration to create an authorized session without completing two-factor authentication.