CVE-2026-62671: CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-login (Grav Login Plugin)to a version that resolves this vulnerability.Fixed in 3.8.11
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Grav Login plugin before 3.8.11 are exposed when a user is logged in and has a session cookie subject to the default SameSite=Lax policy. An anonymous remote attacker can target such a user through an off-site navigation.
What does an attacker need to do to exploit it?
The attacker does not need an account or prior privileges. They need to cause a logged-in victim to navigate to a request invoking the login.regenerate2FASecret task; user interaction is required.
What is the impact on an affected user?
The request overwrites the victim's TOTP secret and forces two-factor re-enrollment. The stated impact is integrity and availability loss, with no confidentiality impact indicated.
How can this be remediated?
Upgrade the Grav Login plugin to version 3.8.11, which fixes the issue. The vulnerable behavior affects versions prior to 3.8.11.