CVE-2026-62671
Received Received - Intake

Forced TOTP Secret Reset in Grav Login Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62671
EUVD
EUVD-2026-62544

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-login to 3.8.11 (exc)
getgrav grav-plugin-login 3.8.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a CSRF flaw in the Grav Login plugin's login.regenerate2FASecret task. It allows an anonymous attacker to rotate a logged-in user's two-factor authentication (TOTP) secret without requiring a nonce or proper authorization. The attack exploits the SameSite=Lax session cookie policy by tricking a victim into visiting a malicious link, which executes the task via a top-level GET request. This desynchronizes the victim's authenticator app, forcing them to re-enroll in 2FA.

Detection Guidance

To detect this vulnerability, check if your Grav Login plugin version is below 3.8.11. Use commands like 'composer show getgrav/grav-plugin-login' or inspect the plugin files for the vulnerable taskRegenerate2FASecret method. Look for missing CSRF protection in login.php and absence of nonce validation in 2fa.js.

Impact Analysis

If you use the Grav Login plugin versions up to 3.8.10 with 2FA enabled, an attacker could trick you into visiting a malicious link. This would overwrite your TOTP secret, locking you out of your account until you re-enroll in 2FA. The attack requires you to be logged in and have 2FA already set up.

Compliance Impact

This vulnerability primarily affects authentication security by allowing unauthorized rotation of a user's two-factor authentication (2FA) secret without proper authorization. While it does not directly impact GDPR or HIPAA compliance, it could indirectly affect compliance by weakening access controls and authentication mechanisms, which are critical for protecting personal and health data under these regulations.

Mitigation Strategies

Immediately update the Grav Login plugin to version 3.8.11 or later. Ensure the regenerate2FASecret task now requires POST requests with a valid nonce. Verify CSRF protection is enabled in login.php and check that 2fa.js includes nonce submission for 2FA regeneration requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart