Critically, the plugin fails to disable the standard password-based login mechanism for these provisioned accounts. Consequently, an unauthenticated remote attacker who identifies the provider identifier - which may be discoverable through system reconnaissance or public interaction - can compute the valid MD5 password hash. This allows the attacker to authenticate as the victim user. If an administrative account is targeted by this process, the attacker can successfully escalate their privileges to full site administrator, leading to complete compromise of the Grav installation.

Impact

Successful exploitation allows unauthenticated remote attackers to gain unauthorized access to any user account provisioned via the OAuth plugin. If an administrator account is affected, the attacker gains full control of the Grav CMS instance, which can be leveraged for data exfiltration, site defacement, or persistent backdooring.

Recommendation

• Immediately upgrade the Grav Login OAuth plugin to version 1.4.3 or later to remediate CVE-2026-109321.
• Audit existing users within the Grav administrative console for any accounts provisioned via OAuth that have unexpectedly enabled local password authentication.
• Review web server access logs for anomalous authentication attempts to the Grav login endpoint, specifically looking for repeated successful logins originating from non-standard IP addresses for known administrative or high-privilege users.