Grav Login OAuth Plugin Vulnerability Allows Unauthenticated Admin Access

The Grav Login OAuth plugin contains a critical security flaw that allows unauthenticated remote attackers to gain administrative control of vulnerable systems. According to the National Vulnerability Database record for CVE-2026-109321, the issue exists in versions of the plugin before 1.4.3 and stems from insecure credential provisioning methods used during account creation.

The vulnerability arises because the plugin provisions OAuth accounts as ordinary Grav users using deterministic credentials. Specifically, it creates usernames in the format of provider identifier followed by the user ID. The password is set as an unsalted MD5 hash of the provider identifier. This predictable structure allows attackers who know or guess the provider identifier to reproduce the credentials and log in.

Technical Context and Impact

The National Vulnerability Database classifies this weakness under CWE-1391 and assigns it a CVSS score of 9.3, marking it as Critical. The core issue is that the plugin fails to disable password login for these OAuth-provisioned accounts. Consequently, the generated credentials remain valid for standard authentication attempts. An attacker does not need to intercept OAuth tokens or compromise the identity provider directly to exploit this flaw.

According to the NVD description, an unauthenticated remote attacker can exploit this by learning or guessing the provider identifier. Once the identifier is known, the attacker can calculate the unsalted MD5 hash to derive the password. Combined with the deterministic username format, this allows the attacker to reproduce the exact credentials used by the system. This leads to unauthorized access, potentially granting administrative control over privileged accounts.

Affected Systems and Scope

This vulnerability specifically impacts installations using the Grav Login OAuth plugin, also known as grav-plugin-login-oauth, in versions earlier than 1.4.3. The flaw is inherent in how the plugin handles the initial provisioning of accounts linked via OAuth. Any site running an affected version that allows OAuth logins is potentially vulnerable. The risk is heightened because the attack vector is remote and requires no prior authentication or user interaction.

The NVD record does not specify which OAuth providers are most commonly targeted, but the exploitability depends on the attacker's ability to identify the provider identifier used by the target system. If the provider identifier is public or easily guessable, the barrier to entry for an attacker is low. The consequence is full account takeover, which can lead to data breaches, defacement, or further lateral movement within the network.

What should you do?

Administrators should immediately audit their Grav installations to determine if the Login OAuth plugin is installed and check its version. If the version is below 1.4.3, users should prioritize updating to the patched version as soon as it is available. Until an update is applied, consider restricting access to the login page or disabling OAuth provisioning if possible. Monitor server logs for unusual login attempts, particularly those using the predictable username patterns described in the advisory.

What to do and how to stay safe: Grav

• Check your Grav installation for the Login OAuth plugin and verify if the version is older than 1.4.3.
• Review access logs for login attempts using usernames that match the provider.identifier pattern.
• Restrict administrative access to trusted IP addresses to mitigate the risk of unauthorized logins.
• Disable password login for OAuth-provisioned accounts if your current plugin version allows this configuration.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-109321?

It is a critical vulnerability in the Grav Login OAuth plugin that allows unauthenticated attackers to guess credentials and gain administrative access.

Which versions of the plugin are affected?

All versions of the Grav Login OAuth plugin prior to 1.4.3 are affected by this security flaw.

How do attackers exploit this vulnerability?

Attackers exploit the predictable username and password format by guessing the provider identifier to generate valid login credentials.