Grav Login Plugin Vulnerability: Critical CVE-2026-56710 Alert
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- grav login plugin (npm)
- Patched version
- 1.0.16
An early warning has been issued for a critical vulnerability in the Grav Login plugin, affecting versions before 1.0.16. This vulnerability allows attackers with api.users.write permission to clear login lockout counters on admin.super accounts, potentially removing brute-force protection.
What happened
The Grav Login plugin, a component used for managing user authentication in Grav-based applications, has been found to contain a critical vulnerability. Versions of the plugin before 1.0.16 do not properly validate the privilege level of the target account when handling the unlock action in the onApiUserListRowAction handler. This oversight enables an attacker with api.users.write permission to reset login lockout counters on admin.super accounts, effectively bypassing brute-force protection mechanisms for these high-privilege accounts.
This vulnerability, tracked as CVE-2026-56710, has a CVSS score of 9.8, indicating its critical severity. The issue was first flagged on August 25, 2026. Although there are no reports of this vulnerability being exploited in the wild, the potential impact on systems using affected versions of the Grav Login plugin is significant.
What to do about it
- Immediately upgrade the Grav Login plugin to version 1.0.16 or later to mitigate the risk.
- Review your application's permission settings to ensure that only trusted users have api.users.write permission.
- Monitor your systems for any unusual activity that may indicate an attempted exploit of this vulnerability.
- Consult the primary sources for the most up-to-date information and additional mitigation strategies.
How 0Day would have caught this
grav login plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Grav Login plugin version before 1.0.16, you are potentially affected by this vulnerability.
What should I do right now?
Upgrade to Grav Login plugin version 1.0.16 or later as soon as possible to protect your system from this vulnerability.
Is there an official fix available?
Yes, the patched version is 1.0.16. Upgrade to this version or later to address the vulnerability.