CyberRota Analysis
AI-GeneratedThe Grav Login plugin prior to version 1.0.16 is vulnerable due to inadequate privilege validation in the unlock handler, allowing attackers with api.users.write permissions to reset login lockout counters for admin.super accounts. This flaw effectively disables brute-force protection for high-privilege accounts, significantly increasing the risk of unauthorized access. Organizations using this plugin should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.