CVE-2026-109314

Executive Summary

CVE-2026-109314 is an information disclosure vulnerability in the Grav Login plugin (versions 1.2.0 through 3.9.8) that allows a publisher-level user to obtain password-reset tokens for higher-privileged accounts. By authoring a page at the reset route, an attacker can cause the Login::getPage() method to render a page that exposes the victim's username and bearer token when the victim opens an emailed reset link. Successful exploitation enables account takeover of more privileged users, resulting in full compromise of the affected Grav site.

Technical Analysis

The vulnerability resides in the Grav Login plugin, a widely used authentication and user-management extension for the Grav flat-file CMS. The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and stems from improper access control over the password-reset route combined with server-side page rendering logic.

According to the NVD description, the Login::getPage() method renders a page controlled by a publisher-level user when a password-reset route is accessed. The reset mechanism is token-based: a victim receives an emailed reset link containing a bearer token. When the victim opens that link, the request is routed through the reset route, where the publisher-authored page is rendered by Login::getPage(). Because the reset token and the victim's username are exposed in this rendered context, the attacker-controlled page can capture them.

The core mechanism is a confused-deputy / information exposure issue: the reset route should be restricted and should never render attacker-supplied content, but it does. The attacker does not need to intercept the email or brute-force the token; the application itself discloses the token to a party who has the capability to publish content at the reset route. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) indicates that exploitation requires network access, low attack complexity, low privileges (publisher role), and user interaction (the victim must open the emailed reset link). Confidentiality and integrity impacts are high because possession of a valid bearer token for a privileged account permits authentication as that user; availability impact is none.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the description provided.

1. Reconnaissance / target identification: The attacker identifies a Grav site running the Login plugin in the affected range (1.2.0–3.9.8) and obtains a low-privileged publisher account. This may be through self-registration, a compromised low-privileged account, or another means of obtaining publishing rights on the site.

2. Triggering the flaw: The attacker authors a page at the password-reset route. Because the reset route renders content through Login::getPage(), the attacker-controlled page is served when the route is accessed.

3. Victim interaction and token capture: The attacker causes a privileged victim to initiate a password reset (or waits for a legitimate reset request). The victim receives an emailed reset link containing a bearer token and opens it. When the victim's browser requests the reset route, the attacker-authored page is rendered by Login::getPage(), and the username and bearer token are exposed in the rendered output. The attacker-controlled page can exfiltrate this data (for example, to an attacker-controlled endpoint) or otherwise record it.

4. Post-exploitation impact: With the victim's username and bearer token, the attacker can authenticate as the privileged account, bypassing the intended reset flow. This enables full account takeover, allowing the attacker to modify site content, install or alter plugins/themes, access administrative functionality, and potentially pivot to other systems if the Grav installation shares credentials or network trust. The CVSS subscores (C:H/I:H) reflect the high confidentiality and integrity impact of a privileged account takeover.

Impact Assessment

Successful exploitation results in complete takeover of a privileged Grav account. The blast radius includes all content, configuration, users, and extensions managed by that account. Because the attacker obtains a valid bearer token rather than cracking a password, the compromise persists until the token is invalidated (for example, by password change or session/token revocation) and is not deterred by password strength or MFA applied only at login. Business impact includes unauthorized modification or exfiltration of site data, defacement, malware or malicious plugin deployment, and lateral movement if the CMS is integrated with internal services. The CVSS base score of 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N reflects a remotely exploitable issue requiring low privileges and user interaction, with high confidentiality and integrity impact and no availability impact.

Detection Guidance

Sigma Rule

title: Grav Login Plugin Password Reset Token Disclosure
id: 8f2a1c44-5b3e-4d9a-9c11-7e6f0a2b1d3c
status: experimental
description: Detects access to the Grav Login plugin reset route consistent with CVE-2026-109314 token disclosure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109314
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_route:
    cs-method: 'GET'
    cs-uri-stem|contains: '/reset'
  selection_agent:
    cs-uri-stem|contains: '/user/plugins/login'
  condition: selection_route or selection_agent
falsepositives:
  - Legitimate password reset flows
level: medium

YARA Rule

rule CVE_2026_109314_Grav_Login_Reset_Token_Disclosure
{
    meta:
        author = "valtersit.com"
        description = "Detects Grav Login plugin artifacts related to CVE-2026-109314 reset token exposure"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109314"
        date = "2026-01-01"
    strings:
        $a = "Login::getPage" ascii wide
        $b = "getPage" ascii wide
        $c = "/user/plugins/login" ascii wide
        $d = "reset" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109314 Grav Login Plugin Reset Token Disclosure Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/reset"; http.uri; content:"login"; reference:cve,2026-109314; classtype:attempted-recon; sid:2026109314; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "GET" and url.path : "*/reset*"]
  [network where http.request.method == "GET" and url.path : "*login*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/reset*" OR uri_path="*/user/plugins/login*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, status
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,grav,">
  <rule id="100314" level="10">
    <if_sid>31100</if_sid>
    <url>/reset</url>
    <description>CVE-2026-109314: Grav Login plugin reset route accessed - possible password reset token disclosure</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict the password-reset route so that it cannot render publisher-authored content; where feasible, deny publisher-level users the ability to create or edit pages that resolve to the reset route. Consider temporarily disabling password reset for privileged accounts or enforcing additional identity verification out-of-band. Monitor and invalidate any reset tokens issued to privileged accounts during the exposure window.

2. Patch/upgrade steps: Upgrade the Grav Login plugin to version 3.9.9 or later, which is the version range boundary indicated in the advisory. Because no vendor advisory or patch reference is available in tracked sources, verify the fix directly against the vendor/plugin repository before deployment and confirm that Login::getPage() no longer renders attacker-controlled content on the reset route.

3. Long-term hardening: Apply least privilege to CMS roles, scrutinize the publisher permission set, enforce MFA at authentication, implement short token lifetimes and one-time-use reset tokens, log and alert on reset-route access, and keep Grav core and all plugins current. Since patch confidence is low, treat this control as compensating rather than complete until an authoritative vendor fix is formally published.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109314
• CWE-200: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1078: https://attack.mitre.org/techniques/T1078/
• FIRST EPSS: https://www.first.org/epss/ (no score assigned at time of writing)
• Grav Login plugin project page: https://github.com/getgrav/grav-plugin-login

No public proof-of-concept, exploit code, Nuclei template, or evidence of exploit-in-the-wild is currently available. CISA KEV does not list this CVE. No threat actor campaigns have been associated with CVE-2026-109314 at the time of writing. Vendor has not published an advisory in tracked sources; verify patch status directly with the vendor before relying on version boundaries.