Grav Login Plugin Vulnerabilities: Password Reset Token Disclosure and 2FA Bypass Issues

• •Grav Login Plugin versions 1.2.0 to 3.9.9 are affected by multiple vulnerabilities.
• •Vulnerabilities include password reset token disclosure and 2FA bypass methods.
• •No patches have been released for these vulnerabilities as of now.

Multiple vulnerabilities have been identified in the Grav Login Plugin, affecting versions 1.2.0 to 3.9.9. The first vulnerability allows unauthorized access to password reset tokens via the reset page, classified as CWE-200. The second vulnerability enables a bypass of two-factor authentication through the profile update form. Additionally, a third vulnerability allows 2FA bypass via the 'Remember Me' cookie. These vulnerabilities could potentially allow attackers to gain unauthorized access to user accounts. The Grav Login Plugin versions 1.2.0 and 2.7.0 are specifically mentioned as affected. No patches have been reported as of the articles' publication date. Security professionals are advised to monitor the situation closely.