The vulnerable task can overwrite a user’s two‑factor secret during a legitimate pending challenge. An attacker who first authenticates with the victim’s password can trigger the secret rotation, receive the new secret, calculate a valid authenticator code, and complete login without requiring the victim’s second factor. This flaw allows an attacker to bypass the 2FA requirement, thereby gaining access to the victim’s account. The weakness stems from improper authorization checks within the 2FA regeneration flow (CWE‑287).

Grav users running the Grav Login plugin version prior to 3.8.11 are impacted. Both the core Grav platform and its login plugin (getgrav:grav-plugin-login) are affected. Version 3.8.11 and later resolve the authorization check and prevent the bypass.

The CVSS score of 7.4 indicates a high severity. EPSS score is not available, and the CVE is not listed in the CISA KEV catalog. The attack requires that the attacker can submit the correct password for the victim and then invoke a task during the 2FA challenge, so it predicated on having basic credential access. Attackers could automate this path in a web‑application context to elevate privileges for compromised accounts. Because the flaw allows complete authentication bypass, it poses a significant risk for any site that relies on Grav’s built‑in 2FA for security.