Veille CVE

Recherche « getgrav grav-plugin-login-oauth »

1 CVE

Critique 1 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « getgrav grav-plugin-login-oauth » ✕
  1. CVE-2026-109321 9.1 Critique

    getgrav grav-plugin-login-oauth

    Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.