External risk intelligence

Grav Login OAuth Plugin Predictable Credentials Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109321

The vulnerability affects a Grav CMS plugin designed to handle user authentication via OAuth. As a web content management system component that provides public-facing login and user management functionality, it is commonly deployed as an internet-accessible web application.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Grav Login OAuth plugin allows unauthenticated attackers to gain administrative control by predicting credentials. It affects how user accounts are provisioned and secured during OAuth logins, potentially exposing privileged accounts. The main concern is confirming relevance and exposure within your Grav CMS deployments.

Predictable login credentials can grant unauthorized admin access.
Affects user authentication, potentially exposing sensitive data.
Confirm if Grav CMS with this plugin is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by guessing or learning the identifier of an OAuth provider used by the Grav Login OAuth plugin. The plugin's predictable username and password generation allows attackers to create accounts with administrative privileges, potentially leading to full system compromise.

No authentication required.
Guess OAuth provider identifier.
Gain administrative control.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated remote attackers could gain administrative control of privileged accounts if they can learn or guess a provider identifier, enabling them to reproduce credentials.

Administrative control of privileged accounts.
Guessing or learning a provider identifier.
Unauthorized access to system and user data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams managing Grav CMS instances are likely responsible for addressing this vulnerability. The first practical step is to identify all Grav instances utilizing the affected plugin, confirm their exposure to the internet, and assess their business criticality to prioritize remediation efforts, which may involve coordinating with the plugin vendor.

Grav CMS owners should address this.
Verify plugin usage and external reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav Login OAuth plugin?

The Grav Login OAuth plugin is an extension for the Grav Content Management System (CMS). Grav is a flat-file CMS, meaning it stores content in files rather than a database. This plugin allows administrators to integrate third-party services—like Google or GitHub—to manage user authentication. It essentially bridges the gap between external identity providers and your Grav-based website, streamlining the login process for site members and administrators.

What is the security weakness in CVE-2026-109321?

This vulnerability is classified as CWE-1391, which relates to the use of predictable credentials. The plugin generates usernames and passwords using a set, deterministic pattern instead of creating unique, secure secrets. Because it uses a simple MD5 hash that is not salted, an attacker who identifies the provider's specific identifier can easily calculate the matching password, allowing them to impersonate accounts.

How does an attacker trigger this vulnerability?

An attacker triggers this by discovering the identifier string used by an OAuth provider connected to your site. No special access or prior authentication is needed; the attacker simply provides the guessed credentials at the login screen. It is important to note that this bug does not rely on complex software exploits. If the plugin is misconfigured to keep password-based login enabled alongside OAuth, the predictable account credentials become valid access keys.

Is my installation at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-priority concern because the Grav Login OAuth plugin is inherently designed for public-facing web interactions. If your Grav CMS instance is internet-accessible, it is considered externally exposed. Systems that allow public login or community access are particularly relevant, as the plugin is commonly deployed to manage exactly these types of user flows.

What should I do first to secure my site?

Start by auditing your environment to locate every instance where the Grav Login OAuth plugin is active. Verify whether your site is accessible from the internet and if it handles sensitive user or administrative accounts. Once you have identified these instances, prioritize them for updates or mitigation. Coordinate with your platform or development team to ensure the plugin is patched to version 1.4.3 or higher, which addresses the credential generation flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.