Executive brief
The Grav CMS Login plugin contains a flaw in its two-factor authentication (2FA) verification logic that allows attackers who know a user's password to bypass the 2FA step and view member-only content. An attacker without access to the user's authenticator app can read pages protected by the authenticated() function or [authenticated] shortcode, though they cannot obtain a fully authenticated session or act as the user. The impact is limited to unauthorized disclosure of gated content on sites that have 2FA enabled.
Technical details
The Login::isAuthenticated() function checks only the session flag indicating successful password entry, not the flag confirming completed login after 2FA. This allows sessions paused at the 2FA code prompt to be treated as fully authenticated when evaluating no-argument authenticated() calls and [authenticated] shortcodes. The vulnerability affects CMS content-access checks via Twig functions and shortcodes but not permission-based authorization via UserObject::authorize() or page-level access rules. Fixed by requiring both flags to pass before authentication is considered complete.
Affected products
- Getgrav Login Plugin >= 3.8.7, < 3.9.7
Timeline
- 2026-09-09: disclosed
- 2026-09-26: patched: Fixed in version 3.9.7