https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 19:28:01 +0000 https://db.gcve.eu/vuln/cve-2026-109312 <p><strong>Affected:</strong> getgrav grav-plugin-login</p> <p>Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim&#39;s password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.</p> <p><strong>Affected:</strong> getgrav grav-plugin-login</p> <p>Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim&#39;s password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.</p> https://db.gcve.eu/vuln/cve-2026-109312