Redwolf1919

**Name of the Vulnerable Software and Affected Versions** Grav Login plugin versions 2.7.0 through 3.9.8 **Description** An authentication bypass exists in the `processUserProfile()` function. The issue occurs because the system verifies the existence of the session user but fails to confirm if a pending front-end two-factor authentication (2FA) session is fully authorized. An attacker possessing a victim's password and the ability to publish a page form without an access rule can invoke `update user` before completing the 2FA process to disable the `twofa enabled` variable and gain full account access. **Recommendations** Update Grav Login plugin to version 3.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** Grav Login plugin versions 2.7.0 through 3.9.8 **Description** An authentication bypass exists that allows attackers possessing a valid password to circumvent two-factor authentication. This is achieved through remember-me cookie restoration, where an attacker obtains a persistent remember-me cookie after the password verification step and uses it to restore a fully authorized session without completing the second authentication factor. **Recommendations** Update Grav Login plugin to version 3.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** Grav Login plugin versions 1.2.0 through 3.9.8 **Description** An information disclosure issue exists where publishers can obtain password-reset tokens by creating a page at the reset route. When a victim accesses an emailed reset link, the page rendered by the `getPage()` function exposes the `username` and `bearer token` variables, which can lead to the takeover of accounts with higher privileges. **Recommendations** Update Grav Login plugin to version 3.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** grav-plugin-api versions prior to 1.0.36 **Description** A privilege escalation issue allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers possessing the `api.users.write` permission can modify account access maps or invitations. This manipulation causes the inheriting permission resolver to satisfy `requireSuper` checks, enabling unauthorized access to API endpoints restricted to super-admins. **Recommendations** Update grav-plugin-api to version 1.0.36 or later.