PT-2026-146625
CVE-2026-126294
·
تاريخ النشر
2026-11-13
·
تاريخ التحديث
2026-11-13
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾