CVE-2026-109321: getgrav grav-plugin-login-oauth, заобикаляне на вход

Описание

Оригинално описание

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

Засегнати продукти

• getgrav grav-plugin-login-oauth: 1.0.0-beta.1 преди 1.4.3; 1.4.3

Вид слабост

• CWE-1391 Use of Weak Credentials

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-109321
• https://nvd.nist.gov/vuln/detail/CVE-2026-109321
• https://github.com/getgrav/grav/security/advisories/GHSA-mj8v-hvf6-73gm
• https://www.vulncheck.com/advisories/grav-login-oauth-plugin-before-1.4.3-predictable-local-credentials-authentication-bypass