CVE-2026-62669: Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofasecret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Login Pluginto a version that resolves this vulnerability.Fixed in 3.8.11 - Compensating control
Until upgraded, restrict access to the task endpoint that can trigger the 'login.regenerate2FASecret' task so it cannot be invoked during a pending TOTP challenge.
Event History
Frequently Asked Questions
What must an attacker have to exploit this issue?
The attacker must know the victim's correct password and be able to submit it far enough to create a pending session at the TOTP challenge. No existing authenticated session or second-factor code is required.
Are accounts without two-factor authentication affected?
The described attack occurs during a pending TOTP challenge and works by replacing the account's twofa_secret. The provided information does not indicate an impact on accounts that do not use TOTP-based two-factor authentication.
Which versions should be remediated?
Grav Login Plugin versions prior to 3.8.11 are affected. Upgrade to version 3.8.11, which includes the fix.
How can defenders identify a potential attempted or successful exploitation?
Review authentication-related activity for regeneration of a twofa_secret during a pending TOTP challenge, followed by successful authentication using a newly generated code. The provided information does not specify log entries, event names, or detection artifacts.