PT-2026-65805 · Getgrav · Grav

Chakrapani150 · CVE-2026-66400 · Published 2026-07-29 · Updated 2026-07-29

NVD

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-66400

Affected Products

Grav

References · 3

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-66400 · Security Note
• https://vulncheck.com/advisories/grav-login-plugin-before-insufficient-session-expiration · Note