CVE-2026-126294: Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login
Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofaenabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Login pluginto a version that resolves this vulnerability.Fixed in 3.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid account password. No prior authenticated session or user interaction is required, and successful exploitation can grant the permissions of the compromised account, including super-admin control when that account is a super-admin.
Which configurations are affected?
The bypass applies when the global twofa_enabled setting is off. In that state, an attacker can avoid two-factor verification through the /login form, a remember-me cookie, or a magic link.
How can I tell whether my deployment is affected?
Check whether the Grav Login plugin version is earlier than 3.11.0 and whether the global twofa_enabled setting is disabled. Deployments meeting both conditions are affected.
What can be done if upgrading is not immediately possible?
Enable the global twofa_enabled setting to avoid the described bypass condition. Also treat passwords for privileged accounts as especially sensitive, since a valid password can be used to obtain a session accepted by the API plugin.