CVE-2026-109314: Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Login pluginto a version that resolves this vulnerability.Fixed in 3.9.9
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs publisher-level ability to author a page at the password-reset route. They must also cause a victim to open a password-reset link sent by email.
Which accounts can be compromised?
An attacker who obtains a victim's username and bearer token from the reset flow can take over that account. The advisory specifically notes that this can enable takeover of more privileged accounts.
Which deployments are affected?
Grav Login Plugin versions from 1.2.0 before 3.9.9 are affected. The provided data does not state whether any particular default configuration prevents the issue.