The Grav Login plugin (getgrav/grav-plugin-login) versions prior to 3.9.1 are vulnerable to email address enumeration. The register() method in classes/Login.php throws a specific exception (EMAIL_NOT_AVAILABLE) when the submitted email address is already associated with an existing account. Since the registration endpoint lacks rate limiting, an attacker can send repeated requests to enumerate valid email addresses registered on the site, one guess per request. This behavior leaks account existence information, which can be leveraged in further targeted attacks.

An attacker can enumerate valid email addresses registered on a Grav site using the vulnerable Login plugin. This information disclosure can facilitate targeted phishing, credential stuffing, or other attacks relying on knowledge of valid user accounts. The vulnerability does not require authentication or user interaction and can be exploited remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting on the registration endpoint to reduce the risk of automated enumeration attacks.