CVE-2026-66400 getgrav CVE debrief

Who should care

Grav site administrators and security teams should assess exposure and update the plugin to version 3.8.13 or later. They should also verify session settings, monitor for suspicious activity, and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and to

Why it matters

CVE-2026-66400 is a medium-severity vulnerability in Grav Login Plugin versions before 3.8.13. The insufficient session expiration allows attackers to authenticate indefinitely with captured Remember Me cookies. Grav site administrators and security teams should assess exposure, update the plugin, verify session settings, and monitor for suspicious activity.

• Potential indefinite authentication for attackers with captured Remember Me cookies
• Possible unauthorized access to Grav sites using vulnerable plugin versions
• Need for verification of current plugin version and session expiration settings
• Requirement for monitoring and adjusting security settings

Technical summary

The Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability. The findTriplet() method in TokenStorage.php fails to properly validate Remember Me token timestamps, allowing attackers with a captured Remember Me cookie to authenticate indefinitely. This issue arises from the comparison of an array to a scalar value, which always evaluates incorrectly in PHP. The vulnerability has a CVSS score of 6.3 and is classified as medium severity. To address this issue, it is recommended to update the plugin to version 3.8.13 or later.

Defensive priority

Medium priority for Grav site administrators and security teams

Recommended defensive actions

• Review and update Grav Login Plugin to version 3.8.13 or later
• Verify and adjust session expiration and Remember Me token settings
• Monitor for suspicious authentication attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on an insufficient session expiration vulnerability in Grav Login Plugin versions before 3.8.13. The findTriplet() method fails to properly validate Remember Me token timestamps, allowing attackers with a captured Remember Me cookie to authenticate indefinitely.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.