CVE-2026-62669
Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.
| CWE | CWE-287 |
| Vendor | getgrav |
| Product | grav |
| Published | Aug 19, 2026 |
| Last Updated | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for getgrav grav
Be the first to know when new high vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
getgrav / grav
< 2.0.4
getgrav / grav-plugin-login
< 3.8.11