A CSRF flaw in the Grav Plugin Login allows an unauthenticated attacker to invoke the login.regenerate2FASecret task through a simple GET request. Because the task requires no CSRF nonce, Origin or Referer checks, an attacker can trick a logged‑in victim into navigating to a crafted URL, causing the plugin to overwrite the victim’s TOTP secret. The user is then forced to re‑enroll for two‑factor authentication and may become locked out if the attacker can reset the secret repeatedly. This is catalogued as CWE‑352.

The vulnerability affects all releases of the Grav Plugin Login supplied by getgrav that precede version 3.8.11. Sites that use the default login.login functionality and maintain user sessions are potential targets.

The CVSS score of 5.4 indicates medium severity, while the EPSS score of less than 1 % shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to have an active authenticated session; the attacker merely needs to host a link or embed an image that sends a GET request. The lack of a CSRF token and the default SameSite=Lax policy make the attack straightforward once the victim visits the malicious page.