Vulnerability in Grav Login Plugin Allows Bypass of Two-Factor Authentication

CVE-2026-62669

What is CVE-2026-62669?

The Grav Login Plugin prior to version 3.8.11 has a significant vulnerability where the login.regenerate2FASecret task inadequately verifies user authorization. An attacker can exploit this flaw by submitting a valid password during a pending TOTP (Time-Based One-Time Password) challenge, allowing them to invoke the taskRegenerate2FASecret() method. This action leads to overwriting the two-factor authentication secret, enabling the attacker to read the new secret from the response, generate a valid TOTP code, and complete the authentication process without the victim's second factor, effectively bypassing the intended security measure.

References