Description
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav-plugin-login-oauth | 1.0.0-beta.1 – < 1.4.3 | 1.4.3 |
References
- GitHub Security Advisory (GHSA-mj8v-hvf6-73gm) vendor-advisory third-party-advisory
- VulnCheck Advisory: Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass third-party-advisory