CVE-2026-109312

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions 2.7.0 through 3.9.8

Description An authentication bypass exists in the processUserProfile() function. The issue occurs because the system verifies the existence of the session user but fails to confirm if a pending front-end two-factor authentication (2FA) session is fully authorized. An attacker possessing a victim's password and the ability to publish a page form without an access rule can invoke update user before completing the 2FA process to disable the twofa enabled variable and gain full account access.

Recommendations Update Grav Login plugin to version 3.9.9 or later.