CVE-2026-66400

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.13

Description Insufficient session expiration occurs in TokenStorage.php within the findTriplet() function. The issue arises because the expiry check compares an array to a scalar value, which always evaluates incorrectly in PHP. This allows an attacker who has captured a Remember Me cookie to maintain authentication indefinitely, bypassing the configured timeout period.

Recommendations Update Grav Login Plugin to version 3.8.13 or later.