Key points
- CVE-2026-109321 is rated critical with a CVSS score of 9.3.
- The flaw exists in versions of the plugin prior to 1.4.3.
- Attackers can create admin accounts by guessing provider identifiers.
Website administrators using the Grav Login OAuth plugin must update to version 1.4.3 immediately. The National Vulnerability Database lists CVE-2026-109321 as a critical security flaw. This vulnerability allows unauthenticated remote attackers to gain administrative control. The issue stems from how the plugin handles new user accounts created through OAuth providers.
In plain English
The plugin creates user accounts using a predictable pattern. It sets the username to a combination of the OAuth provider and a unique identifier. For the password, it uses an unsalted MD5 hash of that same identifier. Because the password generation is deterministic, anyone who knows or guesses the provider identifier can calculate the password. This allows attackers to log in as those users.
The background
According to the NVD record, the vulnerability is classified under CWE-1391. The plugin provisions OAuth accounts as ordinary Grav users without disabling password login. This design choice leaves the backdoor open for credential guessing attacks. Attackers do not need existing credentials or to bypass authentication mechanisms initially. They simply need to reproduce the credentials the system automatically generated for the user.
What changes now
Version 1.4.3 of the grav-plugin-login-oauth addresses this issue. Users running older versions are exposed to remote takeover risks. Administrators should verify their current version and apply the update. Leaving the plugin unpatched invites unauthorized access to privileged account functions. The source material does not specify the technical details of the fix beyond the version number.
Background: OAuth
OAuth handles authorization, allowing apps to access specific resources on your behalf. OpenID handles authentication, proving your identity to a service. You use OAuth to grant permissions and OpenID to log in. Understanding this distinction prevents serious security misconfigurations in your applications.
Read the full guide: OAuth vs OpenID: The Core Difference for Secure Authentication
What to do and how to stay safe: Grav
- Check your Grav installation for the Login OAuth plugin version.
- Update the plugin to version 1.4.3 or later immediately.
- Review user logs for any unauthorized administrative logins.
- Force password resets for all users who logged in via OAuth.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-109321?
It is a critical vulnerability in the Grav Login OAuth plugin that allows attackers to guess user credentials and gain admin access.
Which versions are affected?
All versions of the grav-plugin-login-oauth prior to 1.4.3 are affected by this flaw.
How do attackers exploit this?
Attackers guess the provider identifier, reproduce the deterministic password hash, and log in as the user to seize control.
