CVE-2026-109312: Improper Authentication in getgrav grav-plugin-login

CVE-2026-109312 is an authentication bypass vulnerability in the Grav Login plugin affecting versions >=2.7.0 and <3.9.9. The vulnerability arises because the processUserProfile() function verifies that a session user exists but fails to confirm that a pending front-end 2FA session is fully authorized. This allows an attacker with the victim's password and the ability to publish a page form without an access rule to invoke the update_user function before completing 2FA, thereby disabling the twofa_enabled flag and gaining account control.

Successful exploitation allows attackers to bypass two-factor authentication protections and take over user accounts by disabling 2FA. This significantly undermines account security and can lead to unauthorized access and potential further compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability to publish page forms without access rules and monitor for suspicious activity related to user profile updates. Avoid using affected versions or upgrade once a fixed version is released.