CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Attackers can bypass authentication and gain administrative control by predicting deterministic credentials for OAuth-provisioned accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109321?
CVE-2026-109321 is a critical authentication bypass vulnerability in getgrav grav-plugin-login-oauth, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.
Weakness: CWE-1391
Which versions are affected by CVE-2026-109321?
How do I fix CVE-2026-109321?
No fix has been published for CVE-2026-109321 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-109321 being exploited?
There is no known exploitation of CVE-2026-109321 in the wild and no public exploit code.
Sources
Also known as GHSA-9qx4-jr52-5c2w, GHSA-mj8v-hvf6-73gm.