CVE-2026-114657
Last modified
CVE-2026-114657 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host..
Description
Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-114657?
How severe is CVE-2026-114657?
How do I fix CVE-2026-114657?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-114651A memory-handling weakness in the BSON deserialization compo…4
- CVE-2026-114652A data-query-logic neutralization weakness in the update-sta…6.5
- CVE-2026-114653A client-side encryption schema construction component in th…6.5
- CVE-2026-114654A numeric-type conversion flaw in the BSON handling library …6.5
- CVE-2026-114655libmongocrypt builds requests to external key management ser…5.9
- CVE-2026-114656Traefik before 2.11.58 and 3.7.13 contains an authentication…7.5
- CVE-2026-114658Grav Login plugin from 3.6.0 before 3.9.13 contains a missin…8.8
- CVE-2026-114659Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an aut…6.5
- CVE-2026-11466A weakness has been identified in zilliztech deep-searcher u…5.4
- CVE-2026-114660Grav from 2.0.0 before 2.2.5 contains an improper access con…6.3
- CVE-2026-114661OpenRemote 1.2.0 before 1.31.0 contains a missing authorizat…8.5
- CVE-2026-114662Obot before 0.26.0 contains an authentication bypass vulnera…8.1
Are you affected by CVE-2026-114657?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST