Grav plugins prior to 2.0.4 allow an attacker who already knows a user’s password to overwrite that user’s two‑factor authentication secret. The vulnerability lies in the regenerate2FASecret task, which only checks that a user exists, not that the requester is authorized. By calling this task without a CSRF nonce, an attacker can set the secret to a value of their choice, compute a valid time‑based one‑time password, and complete authentication. The result is a complete defeat of the two‑factor mechanism, leaving the account protected only by its password.

Any installation of Grav that includes the login plugin and runs a version earlier than 2.0.4 is susceptible. The affected product is Grav, provided by Getgrav. Users of older releases should verify version details against the vendor’s release notes and upgrade if necessary.

The CVSS score of 9.1 denotes a critical severity, with the EPSS score indicating a very low but present likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the impact is severe because it remediates two‑factor authentication and permits unauthorized access if an attacker owns a valid password. The likely attack vector is internal or privileged, requiring knowledge of a legitimate user’s password and the ability to send an HTTP request to the regeneration endpoint, but no elevated privileges or CSRF protection are needed.