Description

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer that member's second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, 'group') forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated('some.permission') form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-26T14:16:50.113Z",
  "pubdate": "2026-09-26T14:16:50.113Z",
  "executiveSummary": "The Grav CMS Login plugin, specifically versions 3.8.7 through 3.9.6, contains a critical authentication logic vulnerability. The issue arises from an insufficient validation of session state within the Login::isAuthenticated() function, which prematurely flags users as fully authenticated before the successful completion of the two-factor authentication (2FA) process.\nThis vulnerability allows an attacker possessing a valid user password to circumvent the 2FA requirement when accessing content protected by the authenticated() Twig function or the [authenticated] shortcode. While the attacker cannot achieve a fully elevated session or perform administrative actions, they gain unauthorized read access to gated information intended for authenticated members.\nThe impact is categorized as information disclosure. The vulnerability does not grant session persistence or the ability to bypass granular permission checks, such as those validated via UserObject::authorize(). Successful exploitation requires the attacker to have already compromised or discovered the user's primary password. System administrators should upgrade to version 3.9.7 immediately to enforce correct session state validation.",
  "technicalDetails": "The vulnerability resides in the Login::isAuthenticated() method of the grav-plugin-login package. The root cause is an improper check of the session state flag that governs authorization. In vulnerable versions, the plugin verifies only the completion of the primary password validation step rather than confirming the finalization of the 2FA challenge workflow.\nWhen a user provides valid credentials, the system initiates a session and sets a flag indicating that the password verification has succeeded. However, if 2FA is enabled, the user remains in a state requiring a second factor. The vulnerable implementation of Login::isAuthenticated() incorrectly treats this partial state as a fully authenticated session. Consequently, content gated by the authenticated() Twig function or the [authenticated] shortcode is rendered to the user regardless of the 2FA status.\nThe attack flow proceeds as follows: 1) An attacker obtains a target user's primary password. 2) The attacker attempts to log in to the target Grav CMS instance. 3) The application validates the password and redirects the attacker to the 2FA prompt. 4) Instead of completing the 2FA process, the attacker navigates directly to a URI containing restricted content gated by the [authenticated] shortcode or the authenticated() Twig function. 5) The application calls Login::isAuthenticated(), which sees the 'password verified' session flag and returns true. 6) The restricted content is subsequently served to the attacker's browser.\nThis vulnerability is restricted to content gated by generic authentication checks. It does not affect more robust authorization checks, such as authenticated('some.permission'), because these calls leverage the UserObject::authorize() method, which correctly verifies the user's identity against the full authorization context rather than relying solely on the flawed session flag. The [guest] shortcode is also incorrectly evaluated, as it perceives the partially authenticated attacker as a non-guest user. Because the attacker does not successfully complete the authentication handshake, they cannot perform actions requiring full privileges or bypass URL-based access: rules defined in the system configuration."
}