Grav Login OAuth plugin: Predictable credentials allow authentication bypass

Summary

The Grav Login OAuth plugin creates local accounts for OAuth users with a username in the form <provider>.<id> and a password that is an unsalted MD5 hash of the provider identifier. Password login stays enabled for these accounts. An unauthenticated remote attacker who knows or guesses a provider identifier can derive the credentials and log in, which can give administrative control if the account has admin rights.

Affected

• grav-plugin-login-oauth 1.0.0-beta.1 up to 1.4.2 (VulnCheck range: before 1.4.3)
• The GitHub advisory lists only 1.4.1 as affected; the VulnCheck range is used here.

Fixed in

• Version 1.4.3 according to the vendor advisory. At the time of research, the release could not be confirmed.

Workaround

• Disable the plugin, or change the password of every account named <provider>.<id>.
• Note: disabling the plugin does not remove existing accounts, and the old password still works until it is changed or the account is disabled.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No known exploitation in the wild found at the time of research.
• No public proof of concept found; absence in searches is not proof that none exists.
• Exploitation is not complex: the main barrier is knowing a valid provider identifier.

Our recommendation

• Check whether the plugin is installed and whether OAuth-provisioned accounts exist, especially admin accounts.
• Immediately change the passwords of all accounts named <provider>.<id>, or disable the plugin until a fixed version is confirmed.
• Check the plugin's release page and install version 1.4.3 once it is confirmed as released.
• Review admin and login logs for unusual logins to these accounts.
• Check other Grav plugins, such as the API plugin (CVE-2026-64852, CVE-2026-65007), if they are in use.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-mj8v-hvf6-73gm github.com
• VulnCheck advisory www.vulncheck.com
• OSV entry CVE-2026-109321 osv.dev
• VulDB entry 417143 vuldb.com
• Ionix threat center www.ionix.io
• HOL Guard CVE summary hol.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:28.