Beveiligingsadvies

CVE-2026-66400

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-29 13:32:00

Laatst bijgewerkt 2026-07-29 14:47:35

Toegewezen door VulnCheck

CVSS-score 6.3

Status PUBLISHED

Beschrijving

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

← Alle CVE's bekijken Bekijk op cve.org ↗