The vulnerability allows an adversary who already knows a valid user password to skip the two‑factor authentication step by restoring a previously stolen "remember‑me" cookie. Once the attacker re‑installs the cookie, they receive a fully authorized session, effectively bypassing the second authentication factor and compromising account security. This flaw is an authentication failure (CWE‑287) that can lead to unauthorized access to protected resources.

The Grav CMS Login plugin version 2.7.0 up to and including 3.9.8 is affected. Any Grav site that uses this plugin and has the remember‑me cookie feature enabled is at risk. Sites that have updated the plugin to version 3.9.9 or newer are not impacted.

The CVSS score of 8.6 indicates a high severity risk. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation yet. However, the attack requires only a valid user password and the ability to capture a remember‑me cookie, which are realistic prerequisites for an attacker who has gained user credentials. If such credentials are compromised, the attacker can establish a persistent authorized session without completing the second factor, thus jeopardizing confidentiality of the site’s data.