Grav Login plugin: Two-factor authentication bypass via remember-me cookie
Summary
The Grav Login plugin from version 2.7.0 up to 3.9.8 can create a remember-me cookie after the password step, before the second factor is verified. An attacker who knows the password of an account protected by front-end 2FA can restore this cookie as a fully authorized session without completing the second factor. The flaw is only relevant where front-end 2FA is enabled on a Grav site.
Affected
- Grav Login plugin (getgrav/grav-plugin-login) 2.7.0 up to, but not including, 3.9.9 (CNA record: affected 2.7.0 to < 3.9.9)
- The vendor advisory lists versions up to 3.9.8 as affected and notes that the range is still pending release testing.
Fixed in
- Version 3.9.9 (listed as unaffected by the CNA and as the patched version in the GHSA metadata)
- The GHSA text states that a patched release is not yet available, so confirm the 3.9.9 release on the GitHub advisory page before rollout.
Workaround
Unknown. No vendor workaround is documented.
- Unverified suggestion: disable the remember-me feature in the plugin configuration until patched. Verify this against the vendor advisory before relying on it.
Exploitation
- Not marked as known exploited.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof of concept was found in the research. The reporter is credited as redwolf1919.
Our recommendation
- Inventory all Grav sites and check the Login plugin version.
- Upgrade the Login plugin to 3.9.9 or later and re-test the 2FA login flow.
- Until patched, disable remember-me on sites that protect content with 2FA.
- Review logins for successful sign-ins without a 2FA event and reset passwords where reuse is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cmg5-qw8p-gxcf github.com
- VulnCheck advisory: Grav Login Plugin 2FA bypass via Remember-Me cookie www.vulncheck.com
- OSV: CVE-2026-109313 osv.dev
- OpenCVE: CVE-2026-109313 app.opencve.io
- GitHub Security: getgrav/grav github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:43.
Original description (NVD)
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.