CVE-2026-66400CWE-613

CVE-2026-66400

Medium · published July 29, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-07-29T18:16Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj · [email protected]https://www.vulncheck.com/advisories/grav-login-plugin-before-insufficient-session-expiration · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-mj78-8gwc-vxjj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 JUL 13:32Z
    Grav Login Plugin before 3.8.13 Insufficient Session Expiration
    cvelistv5