CVE-2026-66400

· MEDIUMDeferred

← All CVEs

CVSS v3.1

4.8

CVSS v4.0

6.3

EPSS

0.15%

Published

Jul 29, 2026

Modified

Jul 30, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-613

References (3)

https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj

https://www.vulncheck.com/advisories/grav-login-plugin-before-insufficient-session-expiration

https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj

KEV Catalog EPSS Scores Vendors All CVEs