CVE-2026-109313

Executive Summary

CVE-2026-109313 is an authentication bypass in the Grav Login plugin affecting versions 2.7.0 through before 3.9.9. An attacker who possesses a valid account password can obtain a persistent "remember-me" cookie after the first authentication step and later restore it into a fully authorized session, bypassing the mandatory two-factor authentication (2FA) second factor. Successful exploitation yields authenticated access with high confidentiality and integrity impact (CVSS 8.1), effectively diluting 2FA protections for any Grav site using the vulnerable plugin.

Technical Analysis

The vulnerability class is CWE-287 (Improper Authentication), specifically a logic flaw in the multi-step authentication state machine. The Grav Login plugin implements a two-step login flow: (1) password verification, and (2) a second-factor challenge. It also supports a "remember-me" persistent session mechanism that, on subsequent visits, restores a prior authenticated session via a stored cookie.

The flaw permits a remember-me cookie to be issued/restored as a fully authorized session after only the password step (first factor) has completed — before the second factor is satisfied. In effect, the 2FA gate is not bound to the session state that remember-me restoration trusts. When the cookie is later presented, the plugin treats it as a completed login and reinstates an authorized session, skipping the 2FA challenge entirely.

Per the NVD description, the precondition is possession of a valid password. Thus this is not a credential-stuffing or password-guessing issue; it is a post-password authentication-logic bypass. The attack surface is the web-facing login endpoint of any Grav installation running the vulnerable Login plugin versions. Because the issue is network-reachable, low-complexity, and requires no user interaction (the victim need not be tricked into an action), the exploitability is high; only the "valid password" prerequisite lowers the base subscore (PR:L).

The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, high confidentiality and integrity impact, and no availability impact. CWE classification is CWE-287. No public PoC, exploit code, or Nuclei template is currently available; the description contains insufficient detail to name specific plugin functions, cookie parameter names, or endpoints, so the mechanism above is described at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description, and does not reference unverified function or parameter names.

1. Reconnaissance / target identification. The attacker identifies Grav installations exposing the Login plugin (e.g., pages containing a login form tied to Grav's admin/login routes). Version fingerprinting can narrow targets to the affected range 2.7.0 through before 3.9.9. Targets of interest are sites where 2FA is enabled, since the whole value of the bypass is defeating the second factor.

2. Triggering the flaw class. The attacker supplies a valid username/password pair (obtained via phishing, credential reuse, breach data, or insider access). Instead of completing the normal 2FA challenge, the attacker interacts with the login flow such that the remember-me mechanism provisions/accepts a persistent cookie while the session is only at the password-verified stage, not the fully 2FA-verified stage.

3. Payload/execution method. At the vulnerability-class level, the "payload" is the remember-me cookie itself. The attacker captures this persistent cookie after the password step, then re-presents it to the application during a subsequent request. Because the plugin restores the session from the cookie without re-checking whether the second factor was completed, the request is treated as fully authorized.

4. Post-exploitation impact. The attacker obtains a persistent, fully authorized session as the targeted user. With high confidentiality and integrity impact, this enables access to data and administrative/configuration functions permitted to that account. The "remember-me" nature means the access is durable, extending the window of exposure until the cookie/session is revoked or expires, and is independent of the victim's active participation.

Because no exploit code, template, or forensic artifacts are provided, detection engineering should focus on the authentication-logic anomaly described above rather than known signatures.

Impact Assessment

Business impact is significant for any Grav deployment using the affected Login plugin with 2FA enabled. The bypass defeats a primary defense-in-depth control (the second factor), turning a single compromised password into durable authenticated access — exactly the scenario 2FA is meant to prevent. CVSS subscores:

• Confidentiality: High (C:H) — attackers can read data available to the impersonated account.
• Integrity: High (I:H) — attackers can modify content/settings within that account's privileges.
• Availability: None (A:N) — no direct availability impact.
• Scope: Unchanged (S:U) — impact stays within the vulnerable component.
• Attack Vector: Network (AV:N); Complexity: Low (AC:L); Privileges Required: Low (PR:L, a valid password); User Interaction: None (UI:N). Base score: 8.1.

Blast radius includes all users whose accounts can be targeted and, in particular, privileged accounts. The persistent cookie can prolong unauthorized access, complicating incident response since the attacker may re-authenticate without the victim's involvement. No EPSS score is currently assigned by FIRST.org, and CISA KEV status is NO — there is no confirmed evidence of exploitation in the wild at this time. No vendor fix is identified (patch confidence 0/4, UNPATCHED per tracked sources).

Detection Guidance

Sigma Rule

title: Grav Login Plugin 2FA Bypass via Remember-Me Cookie Restoration
id: 5f0c1a2b-3d4e-4f5a-9b6c-7d8e9f0a1b2c
status: experimental
description: Detects logins where a remember-me session is established without a completed two-factor authentication step, indicating exploitation of CVE-2026-109313 in Grav Login plugin < 3.9.9.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109313
author: valtersit threat intel
date: 2026/01/01
logsource:
  category: application
  product: grav
  service: login
detection:
  selection_remember:
    event:
      - remember_me_restore
      - remember_me_login
    cookie.present: true
  selection_no_2fa:
    two_factor_completed: false
  filter_normal:
    two_factor_required: false
  condition: selection_remember and selection_no_2fa and not filter_normal
falsepositives:
  - Sites where 2FA is not enforced for the account
  - Legitimate remember-me flows for non-2FA users
level: high

YARA Rule

rule CVE_2026_109313_Grav_Login_2FA_Bypass
{
    meta:
        description = "Detects Grav Login plugin files with version strings in the vulnerable range for CVE-2026-109313"
        author = "valtersit threat intel"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109313"
        date = "2026-01-01"
        severity = "high"

    strings:
        $plugin = "login" ascii wide nocase
        $grav = "Grav" ascii wide
        $ver270 = "2.7.0" ascii wide
        $ver380 = "3.8." ascii wide
        $ver390 = "3.9.9" ascii wide

    condition:
        ($grav or $plugin) and
        not $ver390 and
        (filesize < 5MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109313 Grav Login Plugin 2FA Bypass via Remember-Me Cookie"; flow:established,to_server; http.method; content:"GET"; http.cookie; content:"remember"; nocase; reference:cve,2026-109313; classtype:attempted-user; sid:2026109313; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and url.path contains "login"]
  [http where http.request.method == "GET" and http.request.headers["cookie"] contains "remember"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=grav_login
| eval remember_cookie=if(match(_raw,"(?i)remember"),1,0)
| eval twofa_completed=if(match(_raw,"(?i)two_factor|2fa_success|mfa_verified"),1,0)
| where remember_cookie=1 AND twofa_completed=0
| stats count values(uri) by src_ip, user, host
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,grav,">
  <rule id="109313" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">remember_me_restore|remember_me_login</field>
    <field name="two_factor_completed">false</field>
    <description>CVE-2026-109313: Grav Login plugin session restored via remember-me cookie without two-factor completion</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Affected range per the NVD description is Grav Login plugin 2.7.0 before 3.9.9.

1. Immediate mitigations (until an official fix is confirmed):

• Disable the remember-me / persistent-login feature for accounts where 2FA is mandatory, if configurable, so session restoration cannot short-circuit the second factor.
• Enforce 2FA such that the second factor cannot be skipped by any session-restoration path; validate that any restored session requires a completed 2FA state.
• Treat all privileged accounts as requiring interactive re-authentication and shorten session/cookie lifetimes.
• Monitor and rate-limit authentication endpoints; alert on 2FA-enabled accounts establishing sessions without completing the second factor.
• Where feasible, restrict access to the login/admin interface by network controls (VPN, IP allowlist, mTLS) to reduce exposure of the bypass path.

2. Patch/upgrade steps:

• No vendor fix, workaround, or patched version is confirmed by any tracked source at the time of publication. The affected range ends before 3.9.9 per the NVD description; do not assume 3.9.9 resolves the issue without a verified vendor advisory.
• Track the Grav project and the Login plugin repository for an official advisory and release; validate any candidate version against the vendor changelog before deploying.
• After upgrading, rotate credentials and invalidate all existing remember-me cookies and sessions for affected accounts.

3. Long-term hardening:

• Architect authentication so 2FA completion is a required, non-bypassable condition for any session issuance or restoration path.
• Bind second-factor state to the session and cookie; reject cookie-based restoration that does not carry a verified 2FA binding.
• Adopt centralized, tamper-evident authentication logging to detect 2FA-bypass anomalies.
• Conduct code review/threat modeling of multi-step authentication state machines whenever remember-me or persistent-login features are present.

References

• NVD — CVE-2026-109313: https://nvd.nist.gov/vuln/detail/CVE-2026-109313
• CWE-287 (Improper Authentication): https://cwe.mitre.org/data/definitions/287.html
• CVSS v3.1 Specification (FIRST.org): https://www.first.org/cvss/v3.1/specification-document
• Grav project / login plugin repository (verify current version and advisories): https://github.com/getgrav
• CISA Known Exploited Vulnerabilities Catalog (status: not listed as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No confirmed threat actor campaigns or in-the-wild exploitation evidence are associated with CVE-2026-109313 at this time; no public PoC is available. EPSS has not yet scored this CVE.