CVE-2026-66400
Grav Login Plugin before 3.8.13 Insufficient Session Expiration
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.
| CWE | CWE-613 |
| Vendor | getgrav |
| Product | grav |
| Published | Jul 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for getgrav grav
Be the first to know when new medium vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
getgrav / grav
0 < 3.8.13
References
Credits
🔍 chakrapani150