CVE-2026-72700 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations using the getgrav/grav-plugin-login Composer plugin should assess exposure and prioritize patching or mitigation. They should verify the plugin version, apply patches or mitigations, and monitor for suspicious activity related to password reset and account activation. Defenders should also review compensating controls for exposed systems and track exceptions.

Why it matters

CVE-2026-72700 is a high-severity vulnerability in the getgrav/grav-plugin-login Composer plugin. Defenders should prioritize verifying the plugin version and applying patches or mitigations. The vulnerability could potentially allow token recovery via timing differences, but the vendor rates practical exploitability as low. Defenders should monitor for suspicious activity and verify the effectiveness of mitigations.

• Potential token recovery via timing differences requires verification
• Lack of rate limiting on token-submission endpoint may enable repeated guesses
• Vendor rates practical exploitability as low, but defenders should verify
• No end-to-end network exploit has been demonstrated, but defenders should monitor

Technical summary

The getgrav/grav-plugin-login Composer plugin before 3.9.1 uses a non-constant-time === string comparison to compare password reset and account activation tokens. This could potentially allow attackers to recover valid tokens through timing differences. The token-submission endpoint also lacks rate limiting, which could enable repeated token guesses against a known username. The vendor rates practical exploitability as low, but defenders should verify the plugin version and apply patches or mitigations. No end-to-end network exploit has been demonstrated.

Defensive priority

Defenders should prioritize verifying the plugin version and applying patches or mitigations as recommended by the vendor.

Recommended defensive actions

• Verify the plugin version and ensure it is 3.9.1 or later
• Apply patches or mitigations recommended by the vendor
• Monitor for suspicious activity related to password reset and account activation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. The vendor has rated the practical exploitability as low. Evidence is limited to public CVE and NVD data. Defenders should verify the plugin version, assess exposure, and monitor for suspicious activity related to password reset and account activation. No end-to-end network exploit has been demonstrated. The token-submission endpoint lacks rate limiting, enabling repeated token guesses against a known username. The vulnerability is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.