Geoffrey-Diederichs

**Name of the Vulnerable Software and Affected Versions** grav-plugin-login versions 3.8.7 through 3.9.6 **Description** A flaw exists where the two-factor authentication (2FA) challenge can be bypassed for content protected by the `authenticated()` Twig function or the `[authenticated]` shortcode. This occurs because the `Login::isAuthenticated()` function only verifies the session flag for successful password entry rather than confirming the entire login process is complete. Consequently, a session awaiting a 2FA code is incorrectly treated as fully authenticated. An attacker possessing a user's password can access member-only content rendered by the no-argument `authenticated()` form, the group `authenticated(null, 'group')` form, or the `[authenticated]` shortcode. Additionally, the `[guest]` shortcode is evaluated prematurely. The impact is limited to the disclosure of this specific content; the attacker cannot obtain a full session, access pages protected by an `access:` rule, or perform actions as the user. The `authenticated('some.permission')` form is not affected as it utilizes `UserObject::authorize()`. **Recommendations** Update grav-plugin-login to version 3.9.7.