Two-Factor Authentication Bypass in Grav CMS

Executive Summary

CVE-2026-62232 is a two-factor authentication bypass in Grav CMS versions 2.0.3 and earlier. It allows attackers who know a victim's password to bypass 2FA by exploiting improper secret rotation during the pending TOTP challenge window. The attacker calls the regenerate2FASecret task without proper authorization, overwriting the victim's 2FA secret with an attacker-controlled value. This lets them compute valid TOTP codes and complete authentication, reducing 2FA to password-only protection.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS versions for 2.0.3 or earlier. Inspect login plugin logs for unauthorized calls to regenerate2FASecret task without CSRF nonce. Monitor for unexpected 2FA secret changes in user accounts.

Useful 0 Not Useful 0

Impact Analysis

If you use Grav CMS versions 2.0.3 or earlier, an attacker who knows your password could bypass your 2FA and gain unauthorized access to your account. This could lead to data theft, account takeover, or other malicious activities. The attack requires no user interaction and can be executed remotely over the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A successful 2FA bypass could result in unauthorized data exposure, leading to potential violations and penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to version 2.0.4 or later immediately. Disable the login plugin's regenerate2FASecret task if not needed. Implement strict CSRF token validation for all sensitive actions.

Useful 0 Not Useful 0