CVE-2026-109314
HIGH
NVD
CVSS Score
7.3
Severity
HIGH
Published
Oct 12, 2026
Vendor
unknown
Description
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.