The Grav Login plugin prior to version 3.9.9 contains an information disclosure flaw that permits a site publisher to create a page on the reset route. When a user follows an emailed password‑reset link, the page rendered by Login::getPage() leaks the target account’s username and the password‑reset bearer token. Possession of this token enables the attacker to reset the account and assume control of higher‑privilege accounts, effectively bypassing authentication controls.

This vulnerability affects installations of the Grav CMS that use the getgrav:grav-plugin-login plugin, version 1.2.0 up to but not including 3.9.9. Website owners who have publisher privileges on such sites are at risk, as the exploit requires the ability to author content on the reset route.

The flaw has a CVSS score of 8.5, classifying it as high severity. EPSS data is not available, so exploitation probability cannot be quantified precisely, but the lack of a KEV listing suggests no known active exploitation at the time of analysis. The attacker must be a publisher with content‑creation rights and rely on the victim clicking a served reset link. Once the token is captured, the attacker can reset the account password and gain full access to the target account.