CVE-2026-62671 in Login Plugin
Summary
by MITRE • 08/19/2026
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The Grav Login plugin serves as an authentication module for the Grav content management system, providing essential features such as user login capabilities, basic access control lists, and session-wide messaging. A critical security flaw was identified within this plugin prior to version 3.8.11, specifically affecting the task responsible for regenerating Two-Factor Authentication secrets. This vulnerability stems from an insufficient validation of incoming requests targeting the login.regenerate2FASecret endpoint. The TaskServiceProvider allows execution of tasks via URI parameters without enforcing strict origin or referer checks, nor does it require a valid form nonce to authorize state-changing operations.
The technical nature of this flaw is classified as Cross-Site Request Forgery, which corresponds to CWE-352 in the Common Weakness Enumeration standard. The vulnerability exploits the default SameSite=Lax policy applied to session cookies by modern web browsers. Under this policy, cookies are sent with top-level GET requests initiated from external sites. Consequently, an attacker can craft a malicious webpage or link that triggers a request to the vulnerable endpoint when visited by an authenticated user. Because the application does not verify the Origin header or validate a CSRF token specific to the action, it treats the forged request as legitimate and originating from the victim's browser session.
The operational impact of this vulnerability is severe for any deployment relying on Two-Factor Authentication for enhanced security. An attacker who successfully exploits this flaw can force the regeneration of the victim's TOTP secret without their knowledge or consent. This action effectively invalidates the existing two-factor authentication setup, requiring the user to re-enroll in a new 2FA process. Beyond the immediate disruption and potential denial of service caused by locking users out if they cannot complete re-enrollment, this flaw undermines the integrity of the multi-factor security model. It allows an attacker to potentially bypass subsequent login attempts if they can intercept or control the new secret generation phase, although the primary impact is the forced reset that degrades the authentication posture.
This vulnerability aligns with MITRE ATT&CK technique T1534, which covers Cross-Site Request Forgery, as it involves tricking a user into performing an action on a trusted web application. The lack of anti-CSRF protections such as nonce validation and strict origin checking represents a fundamental failure in implementing secure state management practices recommended by industry standards like OWASP.
To mitigate this vulnerability, organizations must upgrade the Grav Login plugin to version 3.8.11 or later, where these checks have been implemented. For systems that cannot immediately update, administrators should ensure that SameSite cookie attributes are set to Strict if feasible for their use case, although upgrading remains the primary remediation path. Additionally, implementing robust CSRF protection mechanisms including unique per-session tokens and strict validation of Origin headers in custom configurations can provide defense-in-depth against similar attacks on other endpoints within the application ecosystem.