- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/19/2026, grav-plugin-login recorded 6 security vulnerabilities in the last 90 days, of which 5 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of grav-plugin-login and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109314Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset PageCVE-2026-109313Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me CookieCVE-2026-109312Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update FormCVE-2026-72699Grav Login Plugin before 3.9.1 Email Enumeration via RegistrationCVE-2026-62671CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)6 Results | Page 1 of 1