CVE-2026-66400 Grav Login Plugin before 3.8.13 Insufficient Session Expiration
Attackers with a captured Remember Me cookie can maintain indefinite access due to flawed token expiration logic in the Grav Login Plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-66400?
CVE-2026-66400 is a medium-severity authentication bypass vulnerability in getgrav grav, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.
Weakness: CWE-613
Which versions are affected by CVE-2026-66400?
How do I fix CVE-2026-66400?
No fix has been published for CVE-2026-66400 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-66400 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66400 exists.
Sources
Also known as GHSA-x4cg-fxgx-67gm.