CVE-2026-62669: Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user->exists(), not $user->authorized can be called without a CSRF nonce. It overwrites the victim’s twofa_secret on disk with an attacker-chosen value, returns the new secret in the JSON response, and the attacker computes a valid TOTP code to complete the 2FA flow. The second factor is reduced to password-only. The exploit was confirmed live after enabling 2FA to a user.
References
- github.com/advisories/GHSA-7mgc-c7pq-3rr3
- github.com/getgrav/grav-plugin-login/commit/5d1b722298cb947d8f434025d121b99152a2c630
- github.com/getgrav/grav-plugin-login/releases/tag/3.8.11
- github.com/getgrav/grav/releases/tag/2.0.4
- github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3
- nvd.nist.gov/vuln/detail/CVE-2026-62669
Code Behaviors & Features
Detect and mitigate CVE-2026-62669 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →