What is GHSA-9qx4-jr52-5c2w?

GHSA-9qx4-jr52-5c2w is a security advisory published by GitHub Security Advisories with Critical severity. Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as...

Which CVE IDs does GHSA-9qx4-jr52-5c2w cover?

GHSA-9qx4-jr52-5c2w covers the following CVE IDs: CVE-2026-109321. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9qx4-jr52-5c2w?

GHSA-9qx4-jr52-5c2w has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-9qx4-jr52-5c2wCriticalCVSS 9.1

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-109321 →

📋 Description

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-mj8v-hvf6-73gm
https://nvd.nist.gov/vuln/detail/CVE-2026-109321
https://www.vulncheck.com/advisories/grav-login-oauth-plugin-before-1.4.3-predictable-local-credentials-authentication-bypass
https://github.com/advisories/GHSA-9qx4-jr52-5c2w