The Grav Login Plugin contains an insufficient session expiration vulnerability in the TokenStorage.php file. Specifically, the findTriplet() method does not correctly validate the timestamps of Remember Me tokens. This is due to a logic error where an array is compared to a scalar value in PHP, which always evaluates incorrectly, allowing an attacker who has obtained a valid Remember Me cookie to authenticate indefinitely instead of being limited by the configured session timeout.

An attacker who captures a valid Remember Me cookie can bypass the intended session expiration controls and maintain persistent authentication indefinitely. This undermines session management security and could allow unauthorized access to user accounts without re-authentication for the duration of the cookie's validity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is available, users should consider invalidating existing Remember Me cookies and monitoring for suspicious authentication activity related to persistent sessions.