The Grav Login OAuth plugin generates OAuth account credentials deterministically, using a predictable <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password. This flaw allows unauthenticated remote users to reconstruct credentials when they know or guess the provider ID, enabling them to log in and gain administrative control of privileged Grav accounts. The weakness is classified as CWE-1391, an Authentication Bypass vulnerability.

The issue affects the Grav plugin grav-plugin-login-oauth by getgrav, specifically any installation running a version earlier than 1.4.3. All users who rely on that plugin for OAuth authentication are exposed until the plugin is updated or disabled.

With a CVSS score of 9.3, the vulnerability is considered Critical. The EPSS score is not available, but the nature of the flaw—deterministic credentials and the inability to disable password login—suggests it could be widely exploited by remote attackers who determine a provider ID. The vulnerability is not listed in the CISA KEV catalog, yet the impact of administrative takeover warrants immediate attention. Exfiltration or further compromise would be possible once an attacker obtains account credentials.