{"id":"CVE-2026-100667","revision":"74a17427babb45d4a3d4a82c40673f74","records":[{"revision":"74a17427babb45d4a3d4a82c40673f74","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100667","aliases":[],"title":"grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass","description":"grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.","state":0,"publishedAt":"2026-09-26T13:23:32.685+00:00","modifiedAt":"2026-09-28T18:14:51.902+00:00","affected":[{"ecosystem":"Vendor product","name":"grav","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"getgrav\",\n                    \"product\": \"grav\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.8.7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.9.7\"\n                        },\n                        {\n                            \"version\": \"3.9.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/getgrav/grav/security/advisories/GHSA-636m-8598-45r9","https://www.vulncheck.com/advisories/grav-plugin-login-3.8.7-through-3.9.6-two-factor-authentication-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100667","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100667","identifiers":["CVE-2026-100667"]},"retained":false,"historicalAffected":[]}],"coverage":[]}