Description

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-10-12T17:17:27.247Z",
  "pubdate": "2026-10-12T17:17:27.247Z",
  "executiveSummary": "The Grav Login OAuth plugin (grav-plugin-login-oauth) prior to version 1.4.3 contains a critical authentication bypass vulnerability.\nThe flaw originates from insecure user provisioning logic where OAuth accounts are created with deterministic usernames and predictable, unsalted MD5-hashed passwords.\nBy failing to disable the local password-based login mechanism for these provisioned accounts, the system allows unauthenticated remote attackers to compromise administrative accounts.\nAn attacker who identifies or successfully guesses a provider identifier can calculate the requisite MD5 hash and gain unauthorized access to the application.\nThis vulnerability grants attackers administrative control, posing a severe risk to the confidentiality, integrity, and availability of the Grav installation.\nExploitation does not require prior authentication, making this an externally exploitable weakness for any site using the vulnerable plugin version.",
  "technicalDetails": "The root cause of this vulnerability lies in the predictable provisioning mechanism implemented by the grav-plugin-login-oauth plugin. When a user authenticates via an OAuth provider, the plugin automatically creates a corresponding local Grav user record if one does not exist.\nThe vulnerability manifests through two primary design failures: the use of a deterministic naming convention for the user record and the use of a weak, easily reproducible hashing algorithm for the account password.\nSpecifically, the plugin assigns usernames using the format <provider>.<id>. Because these components are often discoverable or enumerable, the username component of the credential pair is easily determined by an attacker.\nSimultaneously, the password for these accounts is generated using an unsalted MD5 hash of the provider identifier. Since MD5 is cryptographically broken and the lack of salt renders the hash susceptible to pre-image and rainbow table attacks, the resultant password provides no genuine security.\nThe attack flow proceeds as follows: First, an attacker identifies the target's OAuth provider and the associated provider identifier for an administrative account. Second, the attacker generates the MD5 hash of the provider identifier to use as the password. Third, the attacker initiates a login request using the known username format and the calculated hash. Fourth, because the plugin failed to disable the local password login capability for accounts created via OAuth, the Grav authentication backend processes the credentials as legitimate local password authentication. Upon successful verification of the deterministic hash, the application grants the attacker a session associated with the identity of the targeted account.\nThis behavior facilitates a complete authentication bypass. By targeting an account with administrative privileges, the attacker effectively escalates their access to full system control. The lack of secondary authentication factors or local login restrictions for these accounts ensures that the exploit remains highly reliable and requires minimal technical sophistication once the identifier is discovered.\nAffected versions include all versions of grav-plugin-login-oauth prior to 1.4.3. The exposure is network-wide, as the login interface is typically exposed to public endpoints, requiring no special privilege or network positioning to execute the attack."
}