CVE-2026-109313 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using the Grav Login plugin versions 2.7.0 before 3.9.9, should assess exposure and prioritize remediation due to the high CVSS score of 8.6 and the potential for authentication bypass.

Why it matters

The CVE-2026-109313 vulnerability in the Grav Login plugin allows attackers to bypass 2FA via remember-me cookie restoration, posing a significant risk to Grav installations. Defenders should prioritize verification, upgrading, and monitoring to mitigate potential authentication bypass and unauthorized access.

• Potential authentication bypass for attackers with valid passwords
• Possible unauthorized access to Grav accounts without completing 2FA
• Need for verification of current sessions and monitoring for suspicious activities
• Priority on upgrading to version 3.9.9 or later of the Grav Login plugin

Technical summary

The Grav Login plugin for versions 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. An attacker can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor. This vulnerability poses a significant risk to Grav installations, particularly those using affected versions. Defenders should prioritize verifying and upgrading to version 3.9.9 or later, reviewing current sessions for potential anomalies, and implementing additional monitoring for suspicious login activities to mitigate potential

Defensive priority

Defenders should prioritize verifying and upgrading to version 3.9.9 or later of the Grav Login plugin, reviewing current sessions for potential anomalies, and implementing additional monitoring for suspicious login activities.

Recommended defensive actions

• Verify and upgrade to version 3.9.9 or later of the Grav Login plugin
• Review current sessions for potential anomalies
• Implement additional monitoring for suspicious login activities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the authentication bypass vulnerability in the Grav Login plugin. The vulnerability allows attackers to bypass 2FA via remember-me cookie restoration. The record includes CVSS score and vector, as well as affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.