CVE-2026-62669: Grav 2FA bypass via unauthorized secret regeneration

CVE-2026-62669 · Severity: high · CVSS 7.4 · Published 2026-08-19

Grav is a flat-file CMS that includes two-factor authentication (2FA) via TOTP. An attacker who obtains a user's password can completely bypass 2FA by exploiting a missing authorization check during the 2FA pending-challenge window. The attacker can force the system to regenerate the user's 2FA secret with an attacker-chosen value, compute a valid TOTP code for that secret, and complete the login without the legitimate user's TOTP device. This renders 2FA ineffective and gives the attacker full account access.

Technologies: getgrav/grav (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-62669 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62669 being exploited in the wild.
How severe is CVE-2026-62669?
High severity, with a CVSS score of 7.4, published 19 August 2026.
Which products and versions are affected?
getgrav/grav (Packagist) < 2.0.4.
Is there a fix for CVE-2026-62669?
A patch was published on 2026-09-02: grav-plugin-login 3.8.11 and grav 2.0.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62669 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-62669?
Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authentication and authorization bypass chain in the login plugin (v3.8.10). After a user submits correct credentials, they enter a "pending 2FA" state where `$session->user` is set to the victim user object but `$user->authorized()` returns false. The `taskRegenerate2FASecret` endpoint only checks `$user->exists()`, not `$user->authorized()`, allowing an attacker to overwrite the victim's 2FA secret with an attacker-controlled value. Additionally, this endpoint lacks CSRF protection and can be triggered via a simple GET request. An attacker with the victim's password performs: (1) password login (enters 2FA-pending state), (2) calls the unprotected regenerate endpoint to replace the victim's secret with an attacker-chosen one, (3) computes a valid TOTP using the attacker's secret, and (4) completes 2FA with that code. The victim's legitimate TOTP device is permanently locked out via permanent secret overwrite. Patched in grav-plugin-login 3.8.11 and grav 2.0.4.

Affected products

  • getgrav grav < 2.0.4
  • getgrav grav-plugin-login < 3.8.11

Identifiers

  • CVE-2026-62669
  • GHSA-7mgc-c7pq-3rr3

Timeline

  • 2026-06-29: disclosed: Published to GitHub Advisory Database
  • 2026-09-02: patched: grav-plugin-login 3.8.11 and grav 2.0.4 released with fix
  • 2026-09-02: advisory: CVE-2026-62669 / GHSA-7mgc-c7pq-3rr3 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.