Description
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav-plugin-login | 2.7.0 – < 3.9.9 | 3.9.9 |
References
- GitHub Security Advisory (GHSA-cmg5-qw8p-gxcf) vendor-advisory third-party-advisory
- VulnCheck Advisory: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie third-party-advisory