Grav Login Plugin 1.2.0 Before 3.9.9 Password Reset Token Disclosure Via Reset Page

Back www.vulncheck.com

Grav Login Plugin 1.2.0 Before 3.9.9 Password Reset Token Disclosure Via Reset Page

www.vulncheck.com • October 13, 2026

Share: View original

Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

grav-plugin-login >= 1.2.0, = 1.2.0, < 3.9.9

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

GitHub Security Advisory (GHSA-277m-9x28-gjq2)

VulnCheck Advisory: Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Grav Login Plugin Vulnerabilities: Password Reset Token Disclosure and 2FA Bypass Issues Multiple vulnerabilities have been identified in the Grav Login Plugin, affecting versions 1.2.0 to 3.9.9. The first vulnerability allows unauthorized access to password reset tokens via the reset page, classified as CWE-200. The second vulnerability enables a bypass of two-factor authentication through the profile update form. Additionally, a third vulnerability allows 2FA bypass via the 'Remember Me' cookie. These vulnerabilities could potentially allow attackers to gain unauthorized access to user accounts. The Grav Login Plugin versions 1.2.0 and 2.7.0 are specifically mentioned as affected. No patches have been reported as of the articles' publication date. Security professionals are advised to monitor the situation closely. 34

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-200 - Exposure of Sensitive Information

Platforms (1)

Vulnerabilities (1)

Password Reset Token Disclosure Via Reset Page