CVE-2026-109314: Exposure of Sensitive Information to an Unauthorized Actor in getgrav grav-plugin-login
Description
The Grav Login plugin versions from 1.2.0 up to but not including 3.9.9 contain an information disclosure vulnerability. This flaw allows a publisher to author a page at the password reset route that exposes password-reset tokens when a victim opens the emailed reset link. The exposed information includes usernames and bearer tokens, which can enable an attacker to take over accounts with higher privileges. The vulnerability has a high severity score of 8.5 (CVSS 4.0).
CVSS v4.0
Score 8.5high
Affected software
getgrav
grav-plugin-login
pkg:github/grav-plugin-loginRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109314 is an information disclosure vulnerability in the Grav Login plugin affecting versions >=1.2.0 and <3.9.9. The issue arises because a publisher can create a page at the reset route that, when accessed via a victim's emailed password reset link, causes the Login::getPage() function to render sensitive information including the username and bearer token. This exposure allows an unauthorized actor to potentially take over more privileged accounts by leveraging the disclosed password-reset tokens.
Potential Impact
An attacker with publisher-level access can craft a page that exposes password-reset tokens to victims who click on reset links. This exposure can lead to account takeover of privileged users, compromising the confidentiality and integrity of user accounts within the affected Grav Login plugin installations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict publisher permissions to trusted users only and avoid clicking on unsolicited password reset links. Monitor vendor channels for updates regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:14:27.021Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c132cdf04f656b11bf0
Added to database: 10/12/2026, 16:34:27 UTC
Last enriched: 10/12/2026, 17:04:44 UTC
Last updated: 10/12/2026, 21:46:48 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.