CVE-2026-100667: Missing Critical Step in Authentication in getgrav grav
grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.
AI Analysis
Technical Summary
The Grav CMS Login plugin versions >=3.8.7 and <3.9.7 contain a flaw where the two-factor authentication challenge can be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. The Login::isAuthenticated() method only checked the session flag indicating the password step succeeded, ignoring whether the 2FA step was completed. Consequently, sessions stuck at the 2FA prompt were treated as fully authenticated, allowing attackers with valid passwords but no second factor to access member-only content rendered by these functions. The authenticated('some.permission') form and access: rule protections are unaffected. This vulnerability is addressed in grav-plugin-login version 3.9.7.
Potential Impact
An attacker who knows a member's password but cannot complete the second factor can bypass the 2FA challenge to view member-only content gated by the authenticated() Twig function or [authenticated] shortcode. However, the attacker cannot obtain a fully authenticated session, cannot access pages protected by access rules, and cannot perform actions as the user. The impact is limited to unauthorized disclosure of certain content.
Mitigation Recommendations
Upgrade grav-plugin-login to version 3.9.7 or later, where this vulnerability is fixed. No other mitigation actions are indicated by the vendor advisory.
CVE-2026-100667: Missing Critical Step in Authentication in getgrav grav
Description
grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.
CVSS v4.0
Score 6.9medium
Affected software
getgrav
grav
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Grav CMS Login plugin versions >=3.8.7 and <3.9.7 contain a flaw where the two-factor authentication challenge can be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. The Login::isAuthenticated() method only checked the session flag indicating the password step succeeded, ignoring whether the 2FA step was completed. Consequently, sessions stuck at the 2FA prompt were treated as fully authenticated, allowing attackers with valid passwords but no second factor to access member-only content rendered by these functions. The authenticated('some.permission') form and access: rule protections are unaffected. This vulnerability is addressed in grav-plugin-login version 3.9.7.
Potential Impact
An attacker who knows a member's password but cannot complete the second factor can bypass the 2FA challenge to view member-only content gated by the authenticated() Twig function or [authenticated] shortcode. However, the attacker cannot obtain a fully authenticated session, cannot access pages protected by access rules, and cannot perform actions as the user. The impact is limited to unauthorized disclosure of certain content.
Mitigation Recommendations
Upgrade grav-plugin-login to version 3.9.7 or later, where this vulnerability is fixed. No other mitigation actions are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:34:55.635Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9a9f7a7c5410652fd3e
Added to database: 09/26/2026, 13:33:29 UTC
Last enriched: 09/26/2026, 14:03:24 UTC
Last updated: 09/27/2026, 04:31:27 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.