CVE-2026-109321: Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

Q: Which accounts are at risk?

OAuth accounts provisioned by affected plugin versions are at risk because they are created as ordinary Grav users and retain password-login capability. Privileged OAuth-backed accounts can be taken over with administrative control as the stated impact.

Q: What does an attacker need to log in as an OAuth-provisioned user?

The attacker needs to learn or guess the account's provider identifier. They can derive the username as <provider>.<id> and reproduce the password from the unsalted MD5 hash of that identifier.

Published Oct 12, 2026

Updated

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

Affected Software

1 affected component

Grav Login OAuth Plugin<1.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade grav-plugin-login-oauth to a version that resolves this vulnerability.
Fixed in 1.4.3

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which accounts are at risk?

OAuth accounts provisioned by affected plugin versions are at risk because they are created as ordinary Grav users and retain password-login capability. Privileged OAuth-backed accounts can be taken over with administrative control as the stated impact.

What does an attacker need to log in as an OAuth-provisioned user?

The attacker needs to learn or guess the account's provider identifier. They can derive the username as <provider>.<id> and reproduce the password from the unsalted MD5 hash of that identifier.

Is prior access or user interaction required for exploitation?

No. The issue is described as exploitable by unauthenticated remote attackers, with no privileges or user interaction required.

Which plugin versions should be treated as affected?

Versions of grav-plugin-login-oauth before 1.4.3 should be treated as affected. The supplied data identifies 1.4.3 as the version boundary.

CVE-2026-109321: Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which accounts are at risk?

What does an attacker need to log in as an OAuth-provisioned user?

Is prior access or user interaction required for exploitation?

Which plugin versions should be treated as affected?

Company

Resources

Contact

Frequently Asked Questions

Which accounts are at risk?

What does an attacker need to log in as an OAuth-provisioned user?

Is prior access or user interaction required for exploitation?

Which plugin versions should be treated as affected?