Grav Login OAuth flaw exposes predictable credentials for unauthenticated access
Before version 1.4.3, the plugin sets unsalted MD5 passwords and deterministic usernames, enabling credential guessing attacks.
Key points
- CVE-2026-109321 is rated CVSS 9.3 critical by the NVD.
- The flaw affects Grav Login OAuth versions prior to 1.4.3.
- Attackers can reproduce login credentials using provider identifiers.
The Grav Login OAuth plugin contains a critical vulnerability allowing unauthenticated remote attackers to gain administrative control. Versions before 1.4.3 create user accounts with predictable usernames and weak, reproducible passwords.
What happened
The National Vulnerability Database records CVE-2026-109321 as a critical issue with a CVSS score of 9.3. The flaw exists in the Grav Login OAuth plugin, specifically in releases preceding version 1.4.3. According to the NVD record, the plugin provisions OAuth accounts as standard Grav users. It assigns a deterministic username in the format `<provider>.<id>`.
The password is set to an unsalted MD5 hash of the provider identifier. Password login is not disabled for these accounts. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials. This allows them to log in and gain administrative control of privileged accounts. The NVD associates the weakness with CWE-1391.
Why it matters
The deterministic nature of the credentials makes them susceptible to prediction. An attacker does not need to exploit a complex injection flaw. They only need to know or guess the provider identifier associated with an account. Once guessed, the attacker can compute the unsalted MD5 hash. This hash serves as the password for the corresponding deterministic username.
Because password login remains enabled, the attacker can authenticate directly. The NVD states this grants access to privileged accounts. That suggests the risk is highest where provider identifiers are publicly visible or easily enumerable. The absence of salt in the hash calculation removes a key layer of cryptographic protection. This simplifies the brute-force or guessing process significantly.
Next steps
- Identify all instances of the Grav Login OAuth plugin on managed servers.
- Check current version numbers against the 1.4.3 threshold.
- Monitor logs for failed login attempts using the `<provider>.<id>` pattern.
- Verify that administrative accounts have unique, non-default credentials.
Background: OAuth
OAuth provides delegated, short-lived access for users and services, allowing precise permission control. API keys offer static, long-term identity for server-to-server communication. Choose OAuth for user data and fine-grained control. Choose API keys for simple, automated backend integrations where user context is irrelevant.
Read the full guide: OAuth vs API Key: When to Use Tokens and When to Use Secrets
What to do and how to stay safe: Grav Login OAuth
- Audit installed plugin versions to determine if they precede 1.4.3.
- Review authentication logs for repeated failures on predictable username patterns.
- Enforce strong, unique passwords for all administrative accounts, regardless of origin.
- Once the vendor provides an update, apply it immediately to remediate the flaw.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109321?
The NVD rates the vulnerability as critical with a CVSS score of 9.3.
Which versions of Grav Login OAuth are affected?
All versions before 1.4.3 are affected by this credential exposure flaw.
How do attackers exploit this vulnerability?
Attackers guess or learn provider identifiers to reproduce the unsalted MD5 password hashes.
