PT-2026-65805 · Getgrav · Grav

Chakrapani150 · CVE-2026-66400 · Publicado 2026-07-29 · Atualizado 2026-07-29

NVD

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2026-66400

Produtos afetados

Grav

Referências · 3

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj · Exploit
• https://vulncheck.com/advisories/grav-login-plugin-before-insufficient-session-expiration · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-66400 · Nota de Segurança