Executive brief
Grav is a flat-file CMS that includes two-factor authentication (2FA) via TOTP. An attacker who obtains a user's password can completely bypass 2FA by exploiting a missing authorization check during the 2FA pending-challenge window. The attacker can force the system to regenerate the user's 2FA secret with an attacker-chosen value, compute a valid TOTP code for that secret, and complete the login without the legitimate user's TOTP device. This renders 2FA ineffective and gives the attacker full account access.
Technical details
The vulnerability is an improper authentication and authorization bypass chain in the login plugin (v3.8.10). After a user submits correct credentials, they enter a "pending 2FA" state where `$session->user` is set to the victim user object but `$user->authorized()` returns false. The `taskRegenerate2FASecret` endpoint only checks `$user->exists()`, not `$user->authorized()`, allowing an attacker to overwrite the victim's 2FA secret with an attacker-controlled value. Additionally, this endpoint lacks CSRF protection and can be triggered via a simple GET request. An attacker with the victim's password performs: (1) password login (enters 2FA-pending state), (2) calls the unprotected regenerate endpoint to replace the victim's secret with an attacker-chosen one, (3) computes a valid TOTP using the attacker's secret, and (4) completes 2FA with that code. The victim's legitimate TOTP device is permanently locked out via permanent secret overwrite. Patched in grav-plugin-login 3.8.11 and grav 2.0.4.
Affected products
- getgrav grav < 2.0.4
- getgrav grav-plugin-login < 3.8.11
Timeline
- 2026-06-29: disclosed: Published to GitHub Advisory Database
- 2026-09-02: patched: grav-plugin-login 3.8.11 and grav 2.0.4 released with fix
- 2026-09-02: advisory: CVE-2026-62669 / GHSA-7mgc-c7pq-3rr3 published