The Grav CMS Login plugin allows an attacker who knows a member’s password but not the second factor to view content that is normally protected by the authenticated() Twig function or the [authenticated] shortcode. The vulnerability is caused by the Login::isAuthenticated() method checking only the initial password session flag, not the flag indicating that two‑factor authentication has been completed. This results in a shallow authentication state that satisfies checks for member‑only pages but does not provide a fully authenticated session for further protected resources. The flaw is classified as CWE‑304, which represents unauthorized or insecure use of a security feature.

These vulnerabilities affect Grav CMS Login plugin versions 3.8.7 through 3.9.6. The affected vendor is Getgrav’s Grav CMS. Only installations using the vulnerable plugin range are susceptible; other plugins or unrelated components are not impacted.

The CVSS score of 6.9 places the issue in the Medium severity range. EPSS is not reported and the vulnerability is not listed in the CISA KEV catalog, indicating it has not been widely exploited publicly yet. The likely attack vector requires an attacker to acquire a user’s primary password, through phishing, credential stuffing, or other credential compromise techniques, and then attempt to access member‑only content. Although the attacker cannot bypass access rules or gain a full authenticated session, the exposure of protected content can still be significant for sensitive or confidential material.