Product
Grav Login OAuth plugin before 1.4.3 is vulnerable to account takeover due to the use of deterministic, predictable credentials generated from provider identifiers.