CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-109321 — Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth ...

·Source: NIST NVD

Updated:

Executive Summary

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrativ

Analysis

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts. CVSS Score: 9.1. Published: 2026-10-12T17:17:27.247.

Indicators of Compromise (1)

CVE (1)
CVE-2026-109321
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 12, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Cryptohack Roundup: Turkey Holds Hex Founder, Seizes $7.15M

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-turkey-detains-hex-founder-seizes-715m-image_small-7-a-33174.jpg" align=right hspace=4><b>Also: Fake Ngrave Alerts Linked to $2.65M Crypto Theft</b><br>This week, Turkish police detained Hex founder Richard Heart, attackers exploited Cysic's bridge to mint unauthorized tokens, fake Ngrave alerts led to $2.65 mil

Bank Info Security
MEDIUMVulnerability

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called

The Hacker News
MEDIUMVulnerability

How PHP's Coordinated Disclosure Process Went Belly Up

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/how-phps-coordinated-disclosure-process-went-belly-up-image_small-7-a-33176.jpg" align=right hspace=4><b>Open-Source PHP Team Also Admits to Decision Paralysis After 1 Flaw Found in 2024</b><br>The PHP Foundation said its coordinated vulnerability disclosure process for PHP2Shell worked, until it didn't. A demonstration video of a

Bank Info Security