CVE-2026-62671: medium-severity vulnerability in getgrav grav-plugin-login
CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.2%
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected products
getgrav · grav-plugin-loginRelated CVEs — getgrav grav-plugin-login
In the same product, most dangerous first.
CVE-2026-62669HIGHGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengeEPSS 0.5%CVE-2026-109313HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me CookieEPSS 0.4%CVE-2026-109312HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update FormEPSS 0.4%CVE-2026-109314HIGHGrav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset PageEPSS 0.3%CVE-2026-114658HIGHGrav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.inviteEPSS 0.3%CVE-2026-72699CRITICALGrav Login Plugin before 3.9.1 Email Enumeration via RegistrationEPSS 0.3%