Executive brief
Grav, a popular open-source content management system, contains a security flaw in its login system that allows attackers to bypass two-factor authentication (2FA). If an attacker already knows a user's password, they can exploit this vulnerability to reset the 2FA security key to one they control, effectively locking the legitimate user out and gaining full access to the account. This bypasses the extra layer of security intended to protect sensitive administrative areas and user data.
Technical details
A missing authorization check (CWE-862) in the Grav Login plugin allows for a 2FA bypass. When a user provides valid primary credentials, the system assigns the user object to the session before TOTP verification is complete. During this 'pending-challenge' window, the 'regenerate2FASecret' task can be invoked without a CSRF nonce because it only verifies that a user exists in the session, not that they are fully authorized. An attacker with the victim's password can trigger this task to overwrite the victim's TOTP secret on disk, receive the new secret in the JSON response, and generate a valid code to complete authentication. This vulnerability is patched in Grav version 2.0.4.
Affected products
- getgrav Grav before 2.0.4
Timeline
- 2026-06-29: advisory: Original GitHub security advisory published
- 2026-07-16: patched: Vulnerability addressed in version 2.0.4
- 2026-07-17: disclosed: NVD publication date