Description
Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav | < 3.11.0 | 3.11.0 |
References
- GitHub Security Advisory (GHSA-4x9h-4683-5fcx) vendor-advisory
- VulnCheck Advisory: Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login third-party-advisory