CVE-2026-109321 getgrav CVE debrief

Who should care

Administrators and users of the Grav Login OAuth plugin should assess exposure and upgrade to version 1.4.3 or later. Affected operators, platforms, and security teams need to review and update affected systems, monitor for suspicious activity, and verify affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-109321 is a critical vulnerability in the Grav Login OAuth plugin before 1.4.3, allowing unauthenticated remote attackers to gain administrative control by reproducing predictable local credentials.

• Unauthenticated remote attackers can gain administrative control
• Predictable local credentials can be reproduced
• Authentication bypass is possible

Technical summary

The Grav Login OAuth plugin before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. This allows unauthenticated remote attackers to reproduce these credentials and log in, gaining administrative control of privileged accounts. The vulnerability is due to the plugin's insecure credential generation and lack of proper security measures for OAuth accounts. Affected users should assess exposure and upgrade to version 1.4.3 or later.

Defensive priority

High priority for upgrading to version 1.4.3 or later

Recommended defensive actions

• Upgrade to version 1.4.3 or later
• Review and update affected systems
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. However, details on exploitation and impact are limited. Evidence is based on CVE Program and NVD records. Defenders should verify affected scope, severity, and vendor guidance. Limited source detail suggests cautious validation of affected systems and monitoring for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.