Grav Login Plugin: Password reset token disclosure via publisher-authored page
Summary
The Login plugin for the Grav CMS lets a site page take precedence over the bundled password-reset page. A user with publisher rights can author a page at the reset route, and when a victim opens the emailed reset link, the page renders the username and the bearer reset token. The attacker can then use the token to reset the victim's password, including that of a more privileged account. The CNA rates the issue High (CVSS 4.0 8.5), while VulDB rates it 3.5.
Affected
- grav-plugin-login (getgrav) 1.2.0 up to but not including 3.9.9 (CNA and OSV)
- The GHSA advisory states the range as up to 3.9.8, based on static review
- Unknown: whether versions before 1.2.0 are affected
Fixed in
- 3.9.9 (per CNA, OSV and OpenCVE)
- The GHSA advisory text says no patched release was available when it was written, so confirm the installed version after updating
Workaround
- No workaround is documented in the sources.
- Interim measures (suggestions, not from a source): limit publisher-level accounts, review recently authored pages and check the password-reset route for unexpected content.
Exploitation
- Not known to be exploited; CISA SSVC lists exploitation as none.
- No public proof of concept found.
- EPSS 0.00284.
- Exploitation requires a publisher account and a victim who opens the reset link.
Our recommendation
- Identify all Grav installations and check whether grav-plugin-login is installed and below 3.9.9.
- Update to 3.9.9 and verify the version afterwards.
- Review publisher accounts and recently authored pages, especially pages at the password-reset route.
- Restrict publisher rights to trusted staff and monitor password-reset activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-277m-9x28-gjq2 github.com
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-109314 osv.dev
- OpenCVE CVE-2026-109314 app.opencve.io
- VulDB 417114 vuldb.com
- Rapid7 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:53.
Original description (NVD)
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.