CVE-2026-109313: Grav Login Plugin Auth Bypass Vulnerability

CVE-2026-109313 Overview

CVE-2026-109313 is an authentication bypass vulnerability in the Grav Login plugin versions 2.7.0 through 3.9.8. The flaw allows attackers with valid first-factor credentials to skip two-factor authentication (2FA) by capturing and restoring a remember-me cookie issued after the password step. Successful exploitation yields a fully authorized session without completing the second factor, effectively defeating 2FA protections for Grav CMS administrators and users.

Critical Impact
Attackers holding a valid password can bypass 2FA entirely and establish authenticated sessions on affected Grav instances, compromising confidentiality and integrity of the CMS.

Affected Products

Grav CMS Login plugin version 2.7.0
Grav CMS Login plugin versions after 2.7.0 and before 3.9.9
Grav CMS deployments relying on the Login plugin for 2FA enforcement

Discovery Timeline

2026-10-12 - CVE-2026-109313 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109313

Vulnerability Analysis

The vulnerability is categorized as Improper Authentication [CWE-287]. The Grav Login plugin issues a persistent remember-me cookie during the authentication flow before the second-factor challenge is completed. An attacker who possesses valid credentials can submit the password, intercept or capture the remember-me cookie emitted by the server, and then abandon the 2FA step. Presenting the captured cookie in a subsequent request restores a fully authenticated session that bypasses the 2FA requirement entirely.

This flaw sits in the business logic that governs session state transitions. The remember-me mechanism should only be armed after both authentication factors succeed. Instead, the plugin treats the password step as sufficient to generate durable session material. The attack requires low privileges (a valid password) and no user interaction, and it can be executed over the network.

Root Cause

The root cause is incorrect ordering of authentication state in the Login plugin. The remember-me cookie is bound to an authenticated identity before the 2FA challenge gate has been enforced. This creates a window in which the first-factor-only session artifact carries the authority of a fully authenticated session once replayed.

Attack Vector

Exploitation requires knowledge of a valid username and password for an account that has 2FA enabled. The attacker completes the password step, extracts the issued remember-me cookie from the HTTP response, and then presents that cookie to the Grav instance in a new request. The server restores the session as authorized, skipping the pending 2FA challenge. No code execution or memory corruption primitives are needed. For technical details, see the GitHub Security Advisory GHSA-cmg5-qw8p-gxcf and the VulnCheck Advisory on 2FA Bypass.

Detection Methods for CVE-2026-109313

Indicators of Compromise

Successful authenticated sessions for 2FA-enabled accounts without a corresponding 2FA challenge completion event in Grav logs.
Remember-me cookie values presented from source IP addresses that differ from the IP that completed the password step.
Repeated short-lived password submissions followed by cookie-based session reuse against /admin endpoints.

Detection Strategies

Correlate Grav Login plugin audit entries for password submission events against 2FA completion events. Flag sessions that reach authorized state without a 2FA success record.
Inspect web server access logs for requests to Grav admin paths that carry a remember-me cookie but lack prior 2FA challenge traffic in the same session lineage.
Hunt for anomalous session durations and administrative actions originating from accounts enrolled in 2FA.

Monitoring Recommendations

Enable verbose Grav Login plugin logging and forward authentication events to a central log pipeline.
Monitor the Grav administrative interface for configuration changes, user additions, and plugin installations following any suspicious login.
Alert on remember-me cookie reuse from new user-agent or geolocation signatures tied to privileged accounts.

How to Mitigate CVE-2026-109313

Immediate Actions Required

Upgrade the Grav Login plugin to version 3.9.9 or later on all affected Grav installations.
Invalidate all existing remember-me cookies and force reauthentication for every account with 2FA enabled.
Rotate credentials for administrative accounts if there is any evidence of session reuse without a 2FA event.

Patch Information

The Grav maintainers addressed the authentication state ordering in Login plugin version 3.9.9. Refer to the GitHub Security Advisory GHSA-cmg5-qw8p-gxcf for the official fix and release notes. Apply the update through the Grav Package Manager or by replacing the plugin files directly.

Workarounds

Disable the remember-me feature in the Grav Login plugin configuration until the patched version can be deployed.
Restrict access to the Grav admin interface by IP allowlist or VPN to limit exposure of the authentication endpoint.
Shorten session and cookie lifetimes to reduce the window for cookie replay against unpatched instances.

bash

# Configuration example: disable remember-me in user/config/plugins/login.yaml
rememberme:
  enabled: false
  timeout: 0
  name: grav-site-rememberme
twofa_enabled: true