CVE-2026-109312

Executive Summary

CVE-2026-109312 is an authentication bypass in the Grav Login plugin (versions 2.7.0 before 3.9.9) affecting the processUserProfile() routine, which validates that a session user exists but fails to confirm that a pending front-end two-factor authentication (2FA) session has been fully authorized. An attacker who already possesses a victim's password and can publish a page form lacking an access rule can invoke update_user to set twofa_enabled to disabled before completing 2FA, enabling full account takeover. With a CVSS base score of 8.1, this is a high-severity flaw that undermines the 2FA control specifically on Grav deployments using the Login plugin's front-end profile management features.

Technical Analysis

The vulnerability resides in the Grav Login plugin's processUserProfile() function. According to the NVD description, this function performs a session-user existence check but does not verify that a front-end 2FA session is in a fully authorized state. This is a classic CWE-287 (Improper Authentication) condition: the code treats "a user object exists in session" as equivalent to "the session has passed all authentication factors," conflating partial authentication state with complete authorization.

The second precondition is that an attacker can publish a page form without an access rule. In Grav, page forms are defined in page front matter and can invoke plugin actions; because the form lacks an access rule, the authentication gate that would normally enforce a completed 2FA challenge is absent for that code path. This allows the attacker to reach the update_user action while the 2FA flow is still pending.

The third component is the state-changing action itself: update_user can modify user profile fields, including the twofa_enabled attribute. By invoking update_user to set twofa_enabled to false, the attacker disables the second factor and converts a password-only foothold into full, persistent account access. The interaction of these three elements — an incomplete authorization check, an unrestricted form submission path, and a mutable 2FA flag — is what transforms a partial-credential scenario into a complete authentication bypass.

The attack surface is the front-end, web-facing user profile and 2FA workflow of the Login plugin. Because the flaw is reachable over the network (AV:N), requires low attack complexity (AC:L), and requires the attacker to already hold valid credentials (PR:L), the primary security boundary being violated is the second authentication factor, not the initial password. Note that no public proof-of-concept, exploit code, or Nuclei template is currently available, and the precise code paths beyond processUserProfile() and update_user are not detailed in available intel; the analysis above is confined to what the NVD description states.

Exploitation Scenarios

The following chain is inferred strictly from the NVD description. No public PoC is available.

1. Reconnaissance / target identification: The attacker identifies a Grav site running the Login plugin in an affected version range (2.7.0 to before 3.9.9) that exposes front-end user profile functionality and 2FA. Fingerprinting may rely on Grav-specific response artifacts and Login plugin paths.

2. Triggering the flaw class: The attacker must already possess the victim's password (obtained via phishing, credential stuffing, breach reuse, or prior compromise). The attacker authenticates with the password but cannot complete the front-end 2FA challenge. Instead of satisfying 2FA, the attacker leverages a page form — one the attacker can publish and that has no access rule — to invoke the profile-processing logic (processUserProfile()), which checks only that a session user exists and does not confirm a fully authorized 2FA session.

3. Payload / execution at the vulnerability-class level: Through the unguarded form submission, the attacker invokes the update_user action and sets the user's twofa_enabled flag to disabled. Because the authorization check is incomplete, the state change is accepted without a completed second factor. No specific request syntax, parameter encoding, or endpoint paths beyond the named functions/actions should be assumed, as they are not provided in the source description.

4. Post-exploitation impact: With twofa_enabled disabled, the attacker now holds a fully authenticated account without ever satisfying the second factor. From there the attacker can persist, escalate privileges within Grav's permission model, modify content, or pivot to further compromise depending on account role. Confidentiality and integrity are both rated High in the CVSS vector, with no availability impact.

Impact Assessment

Business impact is significant for organizations using Grav with the Login plugin for content management and front-end membership: any account protected only by password + 2FA becomes effectively password-only if an attacker can publish an unrestricted page form. The CVSS v3.1 subscores are AV:N (network reachable), AC:L (no special conditions), PR:L (attacker needs low-level credentials — the victim's password), UI:N (no user interaction), S:U (scope unchanged), C:H / I:H / A:N. The base score of 8.1 reflects a high-severity authentication bypass with high confidentiality and integrity impact achieved without user interaction.

Blast radius includes any Grav instance running Login plugin versions 2.7.0 through 3.9.8 where (a) 2FA is enabled and (b) an attacker can create or publish a page form lacking an access rule. Administrative and high-privilege accounts are the most attractive targets. Because the attacker already needs the victim's password, this CVE is best characterized as a 2FA bypass / factor-downgrade escalating a partial compromise into full account takeover rather than an unauthenticated remote compromise. EPSS has not yet been scored by FIRST.org, and the CVE is not listed in CISA KEV; no exploit-in-the-wild evidence is currently available.

Detection Guidance

Sigma Rule

title: Grav Login Plugin 2FA Disable via processUserProfile Bypass (CVE-2026-109312)
id: 8f4c2b1a-9d3e-4a7b-b6c2-1e0f5a9d7c44
status: experimental
description: Detects update_user actions toggling twofa_enabled consistent with CVE-2026-109312
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109312
author: valtersit.com
logsource:
  product: grav
  service: login
detection:
  selection_action:
    'action|contains': 'update_user'
  selection_field:
    'field|contains': 'twofa_enabled'
  condition: selection_action and selection_field
falsepositives:
  - Legitimate users disabling their own 2FA after completing MFA
level: high
tags:
  - attack.t1078
  - cve.2026.109312

YARA Rule

rule CVE_2026_109312_Grav_Login_2FA_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP request artifacts attempting to disable twofa_enabled via update_user in Grav Login plugin"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109312"
        date = "2026-01-01"
    strings:
        $a = "update_user" ascii nocase
        $b = "twofa_enabled" ascii nocase
        $c = "processUserProfile" ascii nocase
    condition:
        uint16(0) == 0x4854 or any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109312 Grav Login update_user twofa_enabled bypass attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/user"; http.request_body; content:"update_user"; http.request_body; content:"twofa_enabled"; classtype:attempted-admin; sid:1093120; rev:1;)

Elastic Detection

web where url.path like "%/user%" and method == "POST" and
  stringContains(request.body, "update_user") and
  stringContains(request.body, "twofa_enabled")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=grav
| rex field=_raw "(?i)(?P<action>update_user)"
| rex field=_raw "(?i)(?P<field>twofa_enabled)"
| search action="update_user" field="twofa_enabled"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, user
| where count >= 1

Wazuh OSSEC Rule

<group name="web,grav,cve_2026_109312,">
  <rule id="109312" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>update_user</match>
    <regex>twofa_enabled</regex>
    <description>CVE-2026-109312: Grav Login 2FA disable attempt via update_user bypass</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Enforce access rules on all page forms so that form submissions invoking profile-update actions require a fully authorized session, including completed 2FA. Remove or restrict any page that can publish unrestricted forms.
   • Restrict which accounts can publish pages or create forms, and audit existing pages for forms lacking access controls.
   • Where feasible, temporarily disable front-end user profile self-service edits until the plugin is fixed, and monitor for unexpected changes to the twofa_enabled flag.
   • Since exploitation requires the victim's password, enforce strong password hygiene, credential-stuffing protections, and detection of anomalous logins.

2. Patch/upgrade steps:

   • Upgrade the Grav Login plugin to 3.9.9 or later, per the version boundary stated in the NVD description (2.7.0 before 3.9.9). Verify the installed plugin version and confirm the fix is present after upgrading.
   • No vendor advisory or commit reference is available from tracked sources; validate the fixed version directly against the vendor's official release channel before deployment.

3. Long-term hardening:

   • Treat partial authentication states distinctly from fully authorized sessions in all authentication logic; audit the plugin's session and 2FA state handling.
   • Adopt least-privilege for content publishing and form creation; avoid forms with no access rule.
   • Centralize and monitor authentication events, including 2FA enable/disable changes, and alert on any 2FA downgrade events.
   • Subscribe to Grav/Login plugin security advisories and track CVE-2026-109312 for vendor patch confirmation and any EPSS/KEV updates.

References

• NVD — CVE-2026-109312: https://nvd.nist.gov/vuln/detail/CVE-2026-109312
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Grav Login plugin project page: https://github.com/getgrav/grav-plugin-login
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-109312 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available. No exploit-in-the-wild activity or threat actor campaign has been associated with CVE-2026-109312 at time of writing.