Grav Login OAuth Plugin Uses Weak MD5 Passwords for OAuth Users

The Grav Login OAuth plugin contains a critical authentication bypass that allows unauthenticated remote attackers to gain administrative control. The vulnerability, tracked as CVE-2026-109321, arises from how the plugin creates local user accounts for visitors logging in via external OAuth providers. Instead of disabling password-based login for these accounts, the plugin assigns weak, predictable credentials that can be easily reproduced by an attacker who knows the user’s provider identifier.

Root cause

The core issue lies in the account provisioning logic within the Grav Login OAuth plugin before version 1.4.3. When a user logs in via OAuth, the plugin creates an ordinary Grav user account. It sets the username to a deterministic format combining the provider name and the user ID. Crucially, it generates a password using an unsalted MD5 hash of the provider identifier. Because MD5 is a fast hashing algorithm and no salt is used, the resulting password hash is identical for every user from the same provider, making it trivial to reverse or guess.

Attack path

An attacker does not need to interact with the OAuth provider directly to exploit this flaw. According to the NVD record, the attacker simply needs to learn or guess a valid provider identifier associated with an existing user. Once this identifier is known, the attacker can compute the deterministic username and the corresponding unsalted MD5 password. This allows the attacker to bypass the OAuth flow entirely and log in directly through the standard Grav authentication interface, potentially assuming administrative privileges if the compromised account holds them.

Affected versions

• Grav Login OAuth plugin versions prior to 1.4.3 are affected.
• The vulnerability is rated CVSS 9.3 (Critical) by the National Vulnerability Database.
• The weakness is classified under CWE-1391, indicating improper generation of cryptographic keys or secrets.

Mitigation

• Update the Grav Login OAuth plugin to version 1.4.3 or later immediately.
• Disable password-based login for users who primarily use OAuth authentication.
• Audit existing user accounts to ensure no other plugins are creating predictable credentials.
• Monitor server logs for failed login attempts that may indicate credential guessing attacks.

What to do and how to stay safe: Grav

• Check your Grav installation for the Login OAuth plugin and verify its current version against the affected range.
• Enforce strong, random passwords for all administrative accounts, regardless of how they were created.
• Disable direct password login for user roles that should only access the site via OAuth or SSO.
• Review authentication logs for patterns of failed logins that suggest automated credential stuffing or guessing.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-109321?

It is a critical vulnerability in the Grav Login OAuth plugin that allows unauthenticated attackers to guess user credentials and log in.

Which versions of the plugin are vulnerable?

All versions of the Grav Login OAuth plugin before 1.4.3 are affected by this flaw.

How can an attacker exploit this vulnerability?

By guessing or learning a provider identifier, an attacker can reproduce the deterministic username and unsalted MD5 password to log in.