Is CVE-2026-100667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100667 being exploited in the wild.

How severe is CVE-2026-100667?

Medium severity, with a CVSS score of 5.3, published 26 September 2026.

Which products and versions are affected?

Getgrav Login Plugin >= 3.8.7, < 3.9.7.

Is there a fix for CVE-2026-100667?

A patch was published on 2026-09-26: Fixed in version 3.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100667 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100667?

Check whether you run Getgrav Login Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100667: Grav Login plugin two-factor authentication bypass

Q: Is there a fix for CVE-2026-100667?

A patch was published on 2026-09-26: Fixed in version 3.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100667 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-100667?

Check whether you run Getgrav Login Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100667 · Severity: medium · CVSS 5.3 · Published 2026-09-26

The Grav CMS Login plugin contains a flaw in its two-factor authentication (2FA) verification logic that allows attackers who know a user's password to bypass the 2FA step and view member-only content. An attacker without access to the user's authenticator app can read pages protected by the authenticated() function or [authenticated] shortcode, though they cannot obtain a fully authenticated session or act as the user. The impact is limited to unauthorized disclosure of gated content on sites that have 2FA enabled.

Technologies: Getgrav Login Plugin. Vendors: Getgrav.

Quick answers

Is CVE-2026-100667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100667 being exploited in the wild.
How severe is CVE-2026-100667?: Medium severity, with a CVSS score of 5.3, published 26 September 2026.
Which products and versions are affected?: Getgrav Login Plugin >= 3.8.7, < 3.9.7.
Is there a fix for CVE-2026-100667?: A patch was published on 2026-09-26: Fixed in version 3.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100667 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100667?: Check whether you run Getgrav Login Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Login::isAuthenticated() function checks only the session flag indicating successful password entry, not the flag confirming completed login after 2FA. This allows sessions paused at the 2FA code prompt to be treated as fully authenticated when evaluating no-argument authenticated() calls and [authenticated] shortcodes. The vulnerability affects CMS content-access checks via Twig functions and shortcodes but not permission-based authorization via UserObject::authorize() or page-level access rules. Fixed by requiring both flags to pass before authentication is considered complete.

Affected products

Getgrav Login Plugin >= 3.8.7, < 3.9.7

Timeline

2026-09-09: disclosed
2026-09-26: patched: Fixed in version 3.9.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.