Threat Intelligence Database

The Grav Login plugin versions from 1.2.0 up to but not including 3.9.9 contain an information disclosure vulnerability. This flaw allows a publisher to author a page at the password reset route that exposes password-reset tokens when a victim opens the emailed reset link. The exposed information includes usernames and bearer tokens, which can enable an attacker to take over accounts with higher privileges. The vulnerability has a high severity score of 8.5 (CVSS 4.0).

The Grav Login plugin versions from 2.7.0 up to but not including 3.9.9 contain an authentication bypass vulnerability. This flaw allows attackers who have a valid password to bypass two-factor authentication by exploiting the remember-me cookie mechanism. Specifically, after passing the password step, an attacker can obtain a persistent remember-me cookie and restore it to gain a fully authorized session without completing the second authentication factor.

The Grav Login plugin versions from 2.7.0 up to but not including 3.9.9 contain an authentication bypass vulnerability. This flaw exists in the processUserProfile() function, which improperly checks session user status without verifying full authorization of a pending front-end two-factor authentication (2FA) session. An attacker who knows a victim's password and can publish a page form without an access rule may exploit this to disable two-factor authentication and take over the victim's account.

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.