CyberRota Analysis
AI-GeneratedGrav Login Plugin versions prior to 3.8.13 are vulnerable due to an insufficient session expiration flaw in the TokenStorage.php file, allowing attackers to exploit improperly validated Remember Me token timestamps. This vulnerability enables unauthorized users to maintain authenticated sessions indefinitely by leveraging captured Remember Me cookies, bypassing the intended timeout settings. Organizations using affected versions of the Grav Login Plugin should prioritize patching to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.