Unpatched Grav OAuth plugin exposes sites to remote admin takeover via predictable credentials
A critical flaw in the Grav Login OAuth extension allows attackers to guess user credentials and seize administrative control without authentication.
Key points
- CVE-2026-109321 carries a CVSS score of 9.3, rated critical by the National Vulnerability Database.
- The flaw affects versions of the Grav Login OAuth plugin prior to version 1.4.3.
- Attackers can reproduce valid login credentials using deterministic username and password patterns.
Organisations using the Grav Login OAuth plugin before version 1.4.3 face immediate risk of unauthenticated administrative takeover. The National Vulnerability Database records CVE-2026-109321 as a critical severity issue with a CVSS score of 9.3. The vulnerability stems from how the plugin provisions new user accounts linked to external OAuth providers. It creates standard Grav user accounts using a predictable naming convention and weak password hashing, leaving the system open to credential guessing attacks.
How it unfolded
- The Grav Login OAuth plugin provisions accounts tied to OAuth providers as regular Grav users rather than disabling local password authentication.
- The plugin assigns a deterministic username based on the provider and a unique identifier, following the pattern of <provider>.<id>.
- It sets the user password to an unsalted MD5 hash of the provider identifier, creating a static and reproducible credential string.
Who is affected
Any installation running the Grav Login OAuth plugin below version 1.4.3 is vulnerable to this flaw. According to the NVD record, the issue is classified under CWE-1391. The vulnerability allows unauthenticated remote attackers to gain access if they can determine or guess the provider identifier associated with an account. Because the username and password are derived directly from this identifier using a fixed algorithm, the credentials are not random or secure.
The fix
The vendor has released version 1.4.3 of the Grav Login OAuth plugin to address this vulnerability. This update resolves the issue of deterministic credential provisioning and the lack of disabled password login for OAuth accounts. Users must upgrade to this specific version or later to mitigate the risk of unauthorised administrative access. No other patches or workarounds are mentioned in the available source material for older versions.
What to do and how to stay safe: Grav
- Audit your Grav installations to identify if the Login OAuth plugin is installed and check its current version against 1.4.3.
- Review server logs for unauthorised login attempts or new administrative user creations that may indicate exploitation of this flaw.
- Ensure that local password authentication is disabled for accounts that should only be accessed via OAuth, if upgrading is not immediately possible.
- Monitor vendor announcements for further security updates related to Grav plugins and apply patches as soon as they are verified.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity rating for CVE-2026-109321?
The National Vulnerability Database rates CVE-2026-109321 as critical with a CVSS score of 9.3.
Which versions of the plugin are vulnerable?
All versions of the Grav Login OAuth plugin prior to 1.4.3 are affected by this vulnerability.
How do attackers exploit this flaw?
Attackers can guess or learn a provider identifier and use the deterministic algorithm to reproduce the username and password for administrative access.
