CVE-2026-62669 in Login Plugin
Summary
by MITRE • 08/19/2026
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Grav Login plugin serves as a core component for user management within the Grav content management system, providing essential functionalities such as login handling, basic access control lists, and session-wide messaging. A critical security flaw was identified in versions prior to 3.8.11 regarding the two-factor authentication (2FA) implementation, specifically within the taskRegenerate2FASecret routine. This vulnerability stems from an insufficient authorization check during the process of regenerating a Time-based One-Time Password secret. The intended workflow requires that any operation modifying sensitive security credentials, such as replacing a 2FA secret key, must be strictly bound to an authenticated and authorized user session. However, the flawed implementation only verified the existence of the pending-session user rather than confirming that the user had successfully completed full authentication via $user->authorized.
This logical flaw creates a significant opportunity for account takeover through a bypass of multi-factor authentication controls. An attacker who has obtained or guessed a victim's primary password can initiate the login process and proceed to the two-step verification stage where TOTP codes are required. At this specific juncture, before the session is fully marked as authorized, an attacker with access to the user's active session context can invoke the regenerate2FASecret function. Because the system fails to enforce strict authorization at this step, it allows the overwriting of the existing twofa_secret value without requiring proof that the second factor has been successfully validated by the legitimate owner.
Once the secret is overwritten, the attacker receives a response containing the new replacement secret. With knowledge of this new secret and access to real-time clock synchronization, the attacker can calculate valid TOTP codes for subsequent login attempts. This effectively neutralizes the security benefit provided by two-factor authentication, allowing the attacker to complete the authentication process using only the primary password they already possess. The vulnerability is classified under CWE-287 Improper Authentication because it represents a failure in verifying identity during critical state transitions, and aligns with MITRE ATT&CK technique T1078 Valid Accounts as it exploits legitimate credentials combined with session manipulation to gain unauthorized access.
The operational impact of this vulnerability is severe for any Grav installation relying on the Login plugin for secure user management. It undermines the fundamental assumption that two-factor authentication provides a robust second layer of defense against credential theft or brute-force attacks. Organizations utilizing affected versions are at risk of having their administrative accounts compromised if an attacker can intercept session data or exploit other vulnerabilities to gain initial access. The issue was addressed in version 3.8.11 by correcting the authorization logic within the taskRegenerate2FASecret method to ensure that $user->authorized is strictly required before any changes to security credentials are permitted. Administrators should immediately upgrade to this patched version and review server logs for signs of suspicious session activity or unauthorized secret regeneration events in affected systems.