CVE-2026-66400: Grav Login Plugin Auth Bypass Vulnerability

CVE-2026-66400 Overview

CVE-2026-66400 is an insufficient session expiration vulnerability in the Grav Login Plugin before version 3.8.13. The flaw resides in the findTriplet() method within TokenStorage.php, which fails to correctly validate Remember Me token timestamps. The expiry check compares an array to a scalar value, which always evaluates incorrectly under PHP loose comparison semantics. An attacker who has captured a valid Remember Me cookie can reuse it to authenticate indefinitely, bypassing the configured session timeout. This weakness is categorized under [CWE-613] Insufficient Session Expiration.

Critical Impact
A captured Remember Me cookie remains valid indefinitely, allowing persistent unauthorized access to Grav CMS accounts long after the configured session lifetime expires.

Affected Products

Grav Login Plugin versions before 3.8.13
Grav CMS deployments using the Login Plugin Remember Me feature
Applications relying on TokenStorage.php token expiration logic

Discovery Timeline

2026-07-29 - CVE-2026-66400 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66400

Vulnerability Analysis

The Grav Login Plugin implements a Remember Me feature that stores authentication triplets, consisting of a series identifier, token, and expiration timestamp. When a user returns with a Remember Me cookie, the findTriplet() method in TokenStorage.php searches stored triplets and validates whether the token remains within its configured lifetime.

The validation logic contains a type-handling defect. Instead of comparing the stored expiration timestamp as an integer against the current time, the code compares an array structure to a scalar value. PHP evaluates this comparison in a way that never returns the intended expired state, so the check effectively passes for any age of token.

Because the expiry gate never triggers, Remember Me tokens function as permanent credentials until they are manually rotated or invalidated. An attacker who obtains a Remember Me cookie through cross-site scripting, network capture, malware, or browser session theft retains authenticated access without limit.

Root Cause

The root cause is an incorrect PHP loose comparison between mismatched data types in TokenStorage.php. The findTriplet() method treats a compound array field as if it were the raw expiration timestamp, so the temporal validation branch is unreachable.

Attack Vector

Exploitation requires an attacker to first obtain a valid Remember Me cookie for a target account. Once acquired, the attacker attaches the cookie to requests against the Grav application and is authenticated as the victim. No user interaction is required after cookie capture, and the session persists past the intended timeout.

The vulnerability is described in prose because the maintainers have not published a public proof of concept. Technical details are available in the GitHub Security Advisory and the VulnCheck Advisory on Grav Plugin.

Detection Methods for CVE-2026-66400

Indicators of Compromise

Authenticated sessions originating from Remember Me cookies older than the configured rememberme.timeout value.
Repeated logins from a single account across geographically distant IP addresses using the same persistent cookie.
Access to administrative Grav routes such as /admin following long periods of user inactivity.

Detection Strategies

Audit the Grav Login Plugin version by inspecting user/plugins/login/blueprints.yaml and flag installations below 3.8.13.
Instrument the web application to log Remember Me cookie usage with the associated token issue timestamp, and alert when the token age exceeds the configured lifetime.
Review authentication logs for successful logins that did not include a password submission but produced elevated session privileges.

Monitoring Recommendations

Forward Grav access logs and PHP session data to a centralized logging platform for correlation across accounts and IPs.
Alert on reuse of the same Remember Me cookie identifier from multiple client fingerprints or user-agent strings.
Track administrative actions performed by sessions established through cookie-based authentication rather than interactive login.

How to Mitigate CVE-2026-66400

Immediate Actions Required

Upgrade the Grav Login Plugin to version 3.8.13 or later on all Grav CMS instances.
Invalidate all existing Remember Me tokens by clearing the token storage directory used by the plugin, forcing users to re-authenticate.
Rotate administrative credentials for any account whose Remember Me cookie may have been exposed prior to patching.

Patch Information

The maintainers of Grav addressed the flaw in Login Plugin version 3.8.13. Details of the fix are published in the GitHub Security Advisory GHSA-mj78-8gwc-vxjj. Administrators should apply the update through the Grav Package Manager or by replacing the plugin files directly.

Workarounds

Disable the Remember Me feature in the Login Plugin configuration until the upgrade can be applied.
Shorten the effective session lifetime by enforcing shorter cookie expirations at the reverse proxy or web server layer.
Restrict access to the Grav administrative interface using IP allow-listing or an authenticated reverse proxy while the patch is deployed.

bash

# Configuration example: disable Remember Me in user/config/plugins/login.yaml
rememberme:
  enabled: false
  timeout: 0
  name: grav-site-remember-me