CVE-2026-109321: Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-login-oauthto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which accounts are at risk?
OAuth accounts provisioned by affected plugin versions are at risk because they are created as ordinary Grav users and retain password-login capability. Privileged OAuth-backed accounts can be taken over with administrative control as the stated impact.
What does an attacker need to log in as an OAuth-provisioned user?
The attacker needs to learn or guess the account's provider identifier. They can derive the username as <provider>.<id> and reproduce the password from the unsalted MD5 hash of that identifier.
Is prior access or user interaction required for exploitation?
No. The issue is described as exploitable by unauthenticated remote attackers, with no privileges or user interaction required.
Which plugin versions should be treated as affected?
Versions of grav-plugin-login-oauth before 1.4.3 should be treated as affected. The supplied data identifies 1.4.3 as the version boundary.