CVE-2026-109321: Grav Login OAuth Plugin Predictable Credentials Authentication Bypass
The Grav Login OAuth plugin creates OAuth-linked accounts with deterministic usernames and passwords derived from an unsalted MD5 hash, so an unauthenticated attacker who knows a provider identifier may be able to log in. The record rates the issue critical with a CVSS base score of 9.1 and notes possible takeover of privileged accounts. No confirmed exploitation appears in the sources consulted, and the affected range ends before 1.4.3.
Overview
The Grav Login OAuth plugin (grav-plugin-login-oauth) links OAuth identities to ordinary Grav user accounts. According to the record, these accounts receive a predictable username and a password derived from an unsalted MD5 hash of the provider identifier, and password login is not disabled. The record assigns CWE-1391.
Impact
- Unauthenticated remote attackers who learn or guess a provider identifier may be able to reproduce the credentials.
- A successful login could give administrative control of privileged accounts.
- The record lists a CVSS base score of 9.1 and an SSVC technical impact of total.
Affected products and versions
- Product: Getgrav Grav-plugin-login-oauth.
- Affected range in the record: from 1.0.0-beta.1 up to before 1.4.3.
- No fixed version is listed in the fixes field. The end of the affected range suggests that 1.4.3 or later is outside the range, which is an inference from the data.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00402 (percentile 0.33314) as of 2026-10-23, and the SSVC exploitation field is none.
Remediation and mitigation
- Upgrade the plugin to 1.4.3 or later, as indicated by the end of the affected range.
- Review the vendor advisory for maintainer guidance.
- Audit accounts created through OAuth, change their credentials, and disable password login for them where possible.
- Review administrative accounts for unexpected logins or changes.
Detection guidance
- Review authentication logs for logins to OAuth-provisioned accounts from unexpected sources.
- Look for newly created administrative users or unexpected role changes.
- Monitor for password logins on accounts that were expected to use only OAuth.
Limitations of the available information
- The record has no fixed-version data, so the exact patched release should be confirmed in the vendor advisory.
- The CWE name is not provided in the record.
- The record status is Deferred and no detailed NVD analysis is present.
- This analysis does not include technical reproduction details.
Frequently asked questions
What is the core weakness in this Grav Login OAuth issue?
According to the record, OAuth-provisioned accounts get a predictable username and an unsalted MD5-derived password, and password login is not disabled.
Is this vulnerability known to be actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do?
Update the plugin to 1.4.3 or later, audit OAuth-provisioned and administrative accounts, and review logs for unexpected logins.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.