Grav Login plugin versions 2.7.0 through 3.9.8 contain an authentication bypass in the processUserProfile() routine. The code verifies that a user session exists but fails to confirm that any pending front‑end two‑factor authentication session has been fully authorized. This flaw allows an attacker who knows the victim’s password and can submit a page form without any access restrictions to invoke update_user before completing 2FA, disable the victim’s two‑factor setting, and take over the account.

The vulnerability affects the Grav Login plugin provided by getgrav. All Grav installations that use the plugin between version 2.7.0 (inclusive) and 3.9.9 (exclusive) are potentially exposed.

The CVSS score of 8.6 indicates high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no known public exploitation yet. The likely attack vector is a web‑based form submission that an attacker can manipulate while holding the victim’s password. If the attacker can publish a form with no access rule, they can exploit the flaw before two‑factor authentication is completed, disabling two‑factor and assuming control of the account.