CVE-2026-109312 | BDVDB-2026-386358 Detail

Description#

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-12Record published in the CVE List.
2. Version 22026-10-15Most recent update recorded in the CVE List.