Description
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
Published: 2026-08-19
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a CSRF flaw in grav-plugin-login’s login.regenerate2FASecret task. An unauthenticated attacker can trigger a GET request that overwrites a logged‑in user’s TOTP secret, forcing the user to re‑enroll for two‑factor authentication. This weakness is categorized as CWE‑352.

Affected Systems

The flaw affects the Grav Login Plugin from getgrav, versions prior to 3.8.11. Upgrading to 3.8.11 or later removes the vulnerability.

Risk and Exploitability

The CVSS score of 5.4 indicates a medium severity. Because the attacker only needs an unauthenticated request and a victim’s authenticated session, the risk is moderate. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Attackers could exploit the flaw via a simple cross‑site link or image tag to change a victim’s 2FA secret.

Generated by OpenCVE AI on August 20, 2026 at 01:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade grav-plugin-login to version 3.8.11 or later.
  • If an upgrade is not possible, disable the login.regenerate2FASecret task or enforce a CSRF token on that route, ensuring that only POST requests with a valid nonce are accepted.
  • Configure the Grav session cookie with SameSite=Strict (or add additional Referer checks) to reduce CSRF risk.

Generated by OpenCVE AI on August 20, 2026 at 01:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
Title CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-19T16:41:31.426Z

Reserved: 2026-07-14T20:22:04.394Z

Link: CVE-2026-62671

cve-icon Vulnrichment

Updated: 2026-08-19T16:39:54.365Z

cve-icon NVD

Status : Received

Published: 2026-08-19T16:18:19.757

Modified: 2026-08-19T17:19:54.680

Link: CVE-2026-62671

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T01:15:04Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)