CVE-2026-62671
MediumCVSS 5.4Summary
The Grav Login plugin prior to 3.8.11 accepts the login.regenerate2FASecret task via a top-level GET request without requiring a nonce, Origin check, or Referer check. Under default SameSite=Lax policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the TOTP secret, and force two-factor re-enrollment.
Risk Assessment
An attacker can take over the victim's two-factor authentication, potentially leading to unauthorized account access and security compromise.
Recommendation
Update the Grav Login plugin to version 3.8.11 or later and consider adding additional CSRF protections.
Original NVD description (English source)
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.