CyberRota Analysis
AI-GeneratedThe Grav Login plugin prior to version 3.9.1 is susceptible to email address enumeration due to its handling of existing email addresses during the registration process, which reveals whether an email is already associated with an account. This vulnerability allows attackers to systematically identify valid email addresses linked to user accounts without any rate limiting on the registration endpoint. Organizations using this plugin should prioritize remediation to protect user data and prevent potential account compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.