Medium severity · published Jul 29, 2026
CVE-2026-66400
Grav Login Plugin before 3.8.13 Insufficient Session Expiration
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
before 3.8.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66400
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-login-plugin-before-insufficient-session-expiration
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)