CVE-2026-109321

Summary

The Grav Login OAuth plugin has a critical flaw where OAuth accounts are created with predictable usernames and unsalted MD5 passwords, allowing unauthenticated attackers to gain administrative access by simply knowing or guessing a provider identifier.

Exploitability

Exploitation is straightforward requiring only knowledge of a provider identifier, with no authentication required to create the vulnerable accounts.

Blast radius

The vulnerability could impact all Grav installations using the OAuth plugin version 1.4.2 or earlier, potentially compromising administrative access across multiple user accounts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to grav-plugin-login-oauth version 1.4.3 or later to fix the credential provisioning issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.