high7.3
CVE-2026-109314
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a pag…
Impact
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.
Affected products
| Product | Affected versions |
|---|---|
| Grav Login Plugin 1.2.0 | before 3.9.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.