Grav's Login OAuth plugin before version 1.4.3 creates local accounts with credentials an attacker can work out, so an unauthenticated remote attacker can log in and take administrative control of privileged accounts.
What Is It
CVE-2026-109321 is a critical authentication bypass in the Grav Login OAuth plugin (grav-plugin-login-oauth). When a user signs in through OAuth, the plugin creates an ordinary Grav user account for them. Two things about that account are predictable:
- Username: always follows the pattern
<provider>.<id>. - Password: an unsalted MD5 hash of the provider identifier.
The plugin also leaves password login turned on for these accounts. An attacker who learns or guesses a user's provider identifier can rebuild both the username and the password, then log in directly through the normal password form without going through OAuth at all.
The weakness is classified as CWE-1391. VulnCheck disclosed the issue, and NVD published it on 2026-10-12. The NVD record is in "Received" status.
Why It Matters
VulnCheck rates the flaw CVSS 3.1 9.1 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. It also gives a CVSS 4.0 score of 9.3 (Critical). The attack works over the network, is low in complexity, and needs no privileges or user interaction. A successful attack has a high impact on confidentiality and integrity.
According to the NVD description, attackers can gain administrative control of privileged accounts. That makes this a full site takeover risk for any Grav install where admins or other privileged users sign in through OAuth.
Exploitation status: No CISA KEV entry was supplied for this CVE. The supplied data therefore does not confirm active exploitation. The CVSS 4.0 exploit maturity field is "Not Defined."
What's Vulnerable
- Vendor: getgrav
- Product: grav-plugin-login-oauth
- Affected: versions 1.0.0-beta.1 up to, but not including, 1.4.3
- Unaffected: version 1.4.3
- Repository: https://github.com/getgrav/grav-plugin-login-oauth
The NVD record does not list any affected CPEs.
Patch Status
The affected-version data lists version 1.4.3 as unaffected. Administrators running the Login OAuth plugin should upgrade to 1.4.3 or later. CISA has not issued a required action or due date, since no KEV entry was supplied. See the GitHub security advisory and the VulnCheck advisory below for vendor remediation details.