What’s Vulnerable › Products

getgrav grav-plugin-login vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your getgrav grav-plugin-login version is affected

Latest getgrav grav-plugin-login vulnerabilities

• CVE-2026-114658 — Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite (CVSS 8.8)
• CVE-2026-109314 — Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page (CVSS 7.3)
• CVE-2026-109313 — Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie (CVSS 8.1)
• CVE-2026-109312 — Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form (CVSS 8.1)
• CVE-2026-72699 — Grav Login Plugin before 3.9.1 Email Enumeration via Registration (CVSS 5.3)
• CVE-2026-62671 — CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret) (CVSS 5.4)
• CVE-2026-62669 — Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge (CVSS 7.4)