CVE-2026-62669
Received Received - Intake

Authentication Bypass in Grav Login Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62669
EUVD
EUVD-2026-62540

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav_login_plugin 3.8.11
getgrav grav_cms to 2.0.3 (exc)
grav login_plugin 3.8.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Grav Login Plugin allows an attacker with a victim's correct password to bypass two-factor authentication (2FA). During the pending TOTP challenge, the attacker can overwrite the victim's 2FA secret, read the new secret from the response, calculate a valid code, and complete authentication without the victim's second factor.

Detection Guidance

This vulnerability can be detected by checking the installed version of the Grav Login plugin. If the version is below 3.8.11, the system is vulnerable. Use commands like 'composer show grav-plugin-login' or check the plugin version in the Grav admin panel.

Impact Analysis

An attacker could gain unauthorized access to your Grav account by exploiting this flaw. They only need your password to bypass 2FA, potentially leading to data theft, account takeover, or other malicious activities depending on your account privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection standards like GDPR and HIPAA. It undermines the integrity of authentication mechanisms required by these regulations.

Mitigation Strategies

Immediately update the Grav Login plugin to version 3.8.11 or later. This version includes fixes for improper authorization checks and CSRF protection. After updating, verify that the 2FA secret regeneration requires proper authorization and POST requests with valid nonces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart