CVE-2026-109312 getgrav CVE debrief

Who should care

System administrators and security teams responsible for managing Grav installations should assess exposure and apply necessary updates to prevent authentication bypass attacks. This includes reviewing current plugin versions, verifying 2FA configurations, and monitoring for suspicious activity. Additionally, operators and platform administrators should be aware of the potential impact on their environments and take appropriate measures to mitigate the 2

Why it matters

CVE-2026-109312 allows attackers to bypass 2FA in Grav Login plugin 2.7.0 before 3.9.9. Defenders should update to version 3.9.9 or later, assess exposure, and monitor for suspicious activity.

• Potential account takeover by attackers with a victim's password
• Bypass of two-factor authentication (2FA) via profile update form
• Required verification of Grav Login plugin version and 2FA configuration
• Prioritization of updates to Grav Login plugin version 3.9.9 or later

Technical summary

The Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability in the processUserProfile() function. This function fails to verify that a pending front-end 2FA session is fully authorized before updating user profiles. An attacker with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.

Defensive priority

Defenders should prioritize updating Grav Login plugin to version 3.9.9 or later to mitigate this vulnerability. System administrators and security teams responsible for managing Grav installations should assess exposure and apply necessary updates.

Recommended defensive actions

• Update Grav Login plugin to version 3.9.9 or later
• Assess exposure and apply necessary updates
• Monitor for suspicious profile update activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Supplemental sources include a GitHub Security Advisory (GHSA-5rph-jqcf-2x36) and a VulnCheck Advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.