Skip to content
2FA Vulnerabilities in Grav Login Plugin Allow Account Takeover

2FA Vulnerabilities in Grav Login Plugin Allow Account Takeover

First seen 13 Oct 2026, 16:34 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 17:33 UTC
  • •Two critical vulnerabilities in Grav Login plugin affect versions 2.7.0 to 3.9.8.
  • •Attackers can exploit these flaws to bypass 2FA and take over accounts.
  • •No patches are currently available; users should restrict access until fixes are released.

Two vulnerabilities have been identified in the Grav Login plugin (versions 2.7.0 to 3.9.8) that compromise front-end two-factor authentication (2FA). The first vulnerability allows an attacker to update user profiles while the second factor is pending, potentially removing 2FA requirements and enabling account takeover. The second vulnerability permits the creation of a remember-me cookie before completing the second factor, allowing unauthorized access. Both issues stem from improper session authorization checks during the login process. Static code reviews confirmed the vulnerabilities, but no patches are currently available. Users are advised to monitor for updates and restrict access until a fix is released.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
Vulnerabilities disclosed
Grav Login plugin vulnerabilities GHSA-5rph-jqcf-2x36 and GHSA-cmg5-qw8p-gxcf were disclosed, affecting versions 2.7.0 to 3.9.8.
github.com
2026-10-13
Vulnerabilities confirmed
Static code review confirmed the vulnerabilities in the Grav Login plugin, with no patches available yet.
github.com

More articles in this cluster (2)

Extracted Entities (2)

1 / 3

Common questions

What versions of the Grav Login plugin are affected?
Versions 2.7.0 through 3.9.8 of the Grav Login plugin are affected by these vulnerabilities.
Is there a patch available for these vulnerabilities?
No, a patched release is not yet available for the identified vulnerabilities.
What should users do until a patch is released?
Users should restrict access to their systems and monitor for updates regarding the vulnerabilities.