CVE-2026-109313

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions 2.7.0 through 3.9.8

Description An authentication bypass exists that allows attackers possessing a valid password to circumvent two-factor authentication. This is achieved through remember-me cookie restoration, where an attacker obtains a persistent remember-me cookie after the password verification step and uses it to restore a fully authorized session without completing the second authentication factor.

Recommendations Update Grav Login plugin to version 3.9.9 or later.