Technical impact
The vulnerability, a session management weakness (CWE‑613), exists in Grav Login Plugin versions prior to 3.8.13, where the TokenStorage.php findTriplet() method fails to properly validate Remember Me token timestamps. The expiry check compares an array to a scalar, causing the condition to evaluate incorrectly in PHP. As a result, an attacker who intercepts or otherwise obtains a Remember Me cookie can remain authenticated indefinitely, bypassing the intended session timeout and gaining continued access to the system without reauthentication.
Affected Systems
The issue affects the Grav content management system produced by getgrav, specifically all installations using the Grav Login Plugin before version 3.8.13. Versions 3.8.13 and later contain the fix and are not affected.
Risk and Exploitability
The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The primary attack vector involves possession of a valid Remember Me cookie, which an adversary could obtain through phishing, session hijacking, or local compromise. Once the cookie is captured, the attacker can authenticate indefinitely, potentially accessing sensitive content or administrative functions depending on the user's privileges. No official exploit has been referenced, but the logic flaw enables a straightforward bypass of the session expiration check once the cookie is in hand.
