grav-plugin-login for the Grav content management system contains a CSRF vulnerability in its login.regenerate2FASecret task. The task can be triggered with a simple GET request and regenerates the authenticated user’s TOTP secret without any anti‑CSRF token or Origin/Referer validation, matching the weakness classified as CWE‑352.

This flaw affects installations of Grav where the login plugin is older than version 3.8.11. Any site running the vulnerable plugin with Grav’s default SameSite=Lax session setting is exposed, whereas configurations that enforce SameSite=Strict are not susceptible.

The CVSS score of 2.3 indicates low severity, and the EPSS score is below 1%, showing a very small chance of exploitation. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a CSRF attack that uses a top‑level GET navigation by luring a logged‑in user to an external page, thereby rotating their TOTP secret and forcing them to re‑enroll. The vulnerability only undermines the integrity and availability of two‑factor authentication rather than enabling remote code execution.