CVE-2026-109321 Overview
CVE-2026-109321 is an authentication bypass in the Grav Login OAuth plugin (grav-plugin-login-oauth) before version 1.4.3. The plugin provisions OAuth-authenticated users as ordinary Grav accounts with deterministic credentials. Usernames follow a <provider>.<id> pattern, and the password is an unsalted MD5 hash of the provider identifier. Password-based login is not disabled for these accounts, allowing attackers to reproduce the credentials offline and log in directly. Successful exploitation yields administrative control over privileged OAuth-provisioned accounts without any prior authentication.
Critical Impact
Unauthenticated remote attackers who learn or guess a provider identifier can reproduce valid credentials and gain administrative access to Grav installations.
Affected Products
- Grav CMS installations with the Login OAuth plugin installed
- grav-plugin-login-oauth versions prior to 1.4.3
- Any OAuth-provisioned Grav user accounts, including administrative ones
Discovery Timeline
- 2026-10-12 - CVE-2026-109321 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109321
Vulnerability Analysis
The Login OAuth plugin creates local Grav user accounts for every successful OAuth login. The provisioning logic constructs the account username and password from values that are either public or trivially discoverable. The username is formed as <provider>.<id>, where provider identifies the identity provider (for example github or google) and id is the user identifier returned by that provider. The password is set to the unsalted MD5 hash of the provider identifier value. Because password authentication remains enabled on the resulting account, an attacker can bypass the OAuth flow entirely and authenticate using the derived credentials. This weakness is tracked under CWE-1391: Use of Weak Credentials.
Root Cause
The root cause combines predictable credential generation with insecure password storage. Provider identifiers are frequently exposed through public profiles, repositories, API responses, or enumeration. An unsalted MD5 hash of such a value produces no cryptographic uncertainty for the attacker. The plugin also fails to disable local password login for OAuth-provisioned accounts, so the second authentication factor implied by OAuth is removed from the trust boundary.
Attack Vector
An unauthenticated attacker enumerates or guesses a provider identifier for a target account. The attacker then constructs the deterministic username and computes the matching MD5 password offline. Using the standard Grav login form, the attacker submits those credentials and receives an authenticated session tied to the OAuth-provisioned account. If that account holds administrative privileges, the attacker inherits full control of the Grav instance. Technical details are documented in the GitHub Security Advisory GHSA-mj8v-hvf6-73gm and the VulnCheck advisory.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109321
Indicators of Compromise
- Successful logins to accounts whose usernames match the <provider>.<id> pattern from source IPs that never completed an OAuth redirect.
- Administrative actions performed by OAuth-provisioned accounts shortly after a direct form-based login.
- Password-authentication events against accounts that are expected to authenticate only through an identity provider.
Detection Strategies
- Audit the Grav user/accounts/ directory for accounts following the deterministic naming scheme and verify how each account authenticated.
- Correlate web server access logs for POST requests to the Grav login endpoint against OAuth callback events to identify credential-based access to OAuth accounts.
- Review session creation records for authentications that lack a preceding OAuth state parameter exchange.
Monitoring Recommendations
- Alert on repeated failed logins targeting usernames in the <provider>.<id> format, which may indicate enumeration of provider identifiers.
- Monitor administrative plugin changes, user role modifications, and content edits performed by OAuth-provisioned accounts.
- Ingest Grav application and web server logs into a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-109321
Immediate Actions Required
- Upgrade grav-plugin-login-oauth to version 1.4.3 or later on all Grav installations.
- Inventory existing OAuth-provisioned user accounts and reset their passwords to high-entropy values.
- Revoke active sessions and force re-authentication for any account that may have been provisioned by the vulnerable plugin.
- Review administrative accounts and remove privileges from any OAuth-provisioned user that does not require them.
Patch Information
The maintainers addressed the issue in grav-plugin-login-oauth version 1.4.3. Fixed releases replace the deterministic username and MD5 password scheme and address the password-login exposure for OAuth-provisioned accounts. Refer to the GitHub Security Advisory for the authoritative fix details and upgrade guidance.
Workarounds
- Disable the Login OAuth plugin until the upgrade to 1.4.3 is completed.
- Manually reset the password on every account created by the plugin to a long, random value and store the hash with a modern algorithm.
- Restrict access to the Grav admin interface by IP allowlisting or placing it behind a reverse proxy that enforces additional authentication.
# Configuration example
# Disable the plugin via Grav CLI until patched
bin/gpm uninstall login-oauth
# After upgrading to 1.4.3 or later
bin/gpm update login-oauth
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
