CVE-2026-66400 describes a vulnerability in the Grav Login Plugin where the session expiration mechanism is flawed. Specifically, in versions prior to 3.8.13, the findTriplet() method in TokenStorage.php fails to properly validate the expiration of Remember Me tokens. The expiry check compares an array to a scalar value, which in PHP always evaluates incorrectly, effectively disabling the expiration check. As a result, an attacker possessing a captured Remember Me cookie can maintain indefinite authenticated sessions, circumventing configured timeout policies. No official patch or remediation level has been confirmed as of the published date.

An attacker with access to a captured Remember Me cookie can maintain indefinite authenticated access to the affected Grav system, bypassing the intended session expiration controls. This undermines session security and could lead to unauthorized persistent access without needing to re-authenticate. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity), indicating a moderate risk with network attack vector, high attack complexity, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider invalidating existing Remember Me cookies and disabling the Remember Me feature if feasible. Monitoring for suspicious session activity related to persistent authentication tokens is recommended. Avoid relying solely on the vulnerable session expiration mechanism for security.