CVE-2026-66400
Grav Login Plugin before 3.8.13 Insufficient Session Expiration
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jul 29, 2026
- Updated
- Jul 29, 2026
- Reserved
- Jul 26, 2026
Description
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-613 Insufficient Session Expiration
Affected Products
| Product | Versions |
|---|---|
gravgetgrav |
|
References
- GitHub Security Advisory (GHSA-mj78-8gwc-vxjj)vendor-advisory
- VulnCheck Advisory: Grav Login Plugin before 3.8.13 Insufficient Session Expirationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.