{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agetgravgrav-plugin-login-oauth/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav-plugin-login-oauth:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-109321"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["grav-plugin-login-oauth (\u003c 1.4.3)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eThe Grav Login OAuth plugin (grav-plugin-login-oauth) versions prior to 1.4.3 contain a critical authentication bypass vulnerability. During the account provisioning process for OAuth-authenticated users, the plugin generates account credentials using predictable patterns. Specifically, it assigns a username based on the format 'provider.id' and sets the user password to an unsalted MD5 hash of the provider identifier.\u003c/p\u003e\n\u003cp\u003eCritically, the plugin fails to disable the standard password-based login mechanism for these provisioned accounts. Consequently, an unauthenticated remote attacker who identifies the provider identifier - which may be discoverable through system reconnaissance or public interaction - can compute the valid MD5 password hash. This allows the attacker to authenticate as the victim user. If an administrative account is targeted by this process, the attacker can successfully escalate their privileges to full site administrator, leading to complete compromise of the Grav installation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to gain unauthorized access to any user account provisioned via the OAuth plugin. If an administrator account is affected, the attacker gains full control of the Grav CMS instance, which can be leveraged for data exfiltration, site defacement, or persistent backdooring.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade the Grav Login OAuth plugin to version 1.4.3 or later to remediate CVE-2026-109321.\u003c/li\u003e\n\u003cli\u003eAudit existing users within the Grav administrative console for any accounts provisioned via OAuth that have unexpectedly enabled local password authentication.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous authentication attempts to the Grav login endpoint, specifically looking for repeated successful logins originating from non-standard IP addresses for known administrative or high-privilege users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:31:32Z","date_published":"2026-10-12T18:31:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grav-oauth-auth-bypass/","summary":"Grav Login OAuth plugin before 1.4.3 is vulnerable to account takeover due to the use of deterministic, predictable credentials generated from provider identifiers.","title":"Authentication Bypass in Grav Login OAuth Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-grav-oauth-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:getgrav:grav-Plugin-Login-Oauth:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}