Cross-Site Request Forgery Vulnerability in Grav Login Plugin by Grav

CVE-2026-62236

What is CVE-2026-62236?

The grav-plugin-login version before 3.8.11 has a significant cross-site request forgery vulnerability. This issue stems from the login.regenerate2FASecret frontend task, where an attacker can exploit the absence of proper anti-CSRF protections to manipulate the TOTP secret for the authenticated user session. By tricking the logged-in user into visiting a malicious site, an attacker can trigger a request that alters the user's 2FA settings without their consent. As a consequence, the user's authenticator app becomes unsynchronized, requiring them to re-enroll in two-factor authentication. It's important to note that sites configured with session.samesite set to Strict are not vulnerable to this attack. For detailed mitigation strategies, refer to the advisories connected with this vulnerability.

References