The Grav Login plugin versions prior to 1.0.16 do not properly validate the privilege level of target accounts in the onApiUserListRowAction unlock handler. This flaw enables an attacker who has api.users.write permission to reset the login lockout counters on admin.super accounts. Consequently, brute-force protections on these high-privilege accounts can be circumvented, potentially allowing repeated login attempts without lockout.

An attacker with api.users.write permission can disable brute-force protection on the highest-privilege admin.super accounts by clearing their login lockout counters. This increases the risk of successful brute-force attacks against these critical accounts, potentially leading to unauthorized administrative access.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict api.users.write permissions to trusted users only to reduce the risk of exploitation.