# CVE-2026-62669: Grav 2FA bypass via unauthorized secret regeneration

Source: https://junglewise.ai/threats/cve-2026-62669-grav-2fa-bypass-via-unauthorized-secret-regeneration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62669 · Severity: high · CVSS 7.4 · Published 2026-08-19

Grav is a flat-file CMS that includes two-factor authentication (2FA) via TOTP. An attacker who obtains a user's password can completely bypass 2FA by exploiting a missing authorization check during the 2FA pending-challenge window. The attacker can force the system to regenerate the user's 2FA secret with an attacker-chosen value, compute a valid TOTP code for that secret, and complete the login without the legitimate user's TOTP device. This renders 2FA ineffective and gives the attacker full account access.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-62669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62669 being exploited in the wild.

**How severe is CVE-2026-62669?** High severity, with a CVSS score of 7.4, published 19 August 2026.

**Which products and versions are affected?** getgrav/grav (Packagist) < 2.0.4.

**Is there a fix for CVE-2026-62669?** A patch was published on 2026-09-02: grav-plugin-login 3.8.11 and grav 2.0.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62669 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62669?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authentication and authorization bypass chain in the login plugin (v3.8.10). After a user submits correct credentials, they enter a "pending 2FA" state where `$session->user` is set to the victim user object but `$user->authorized()` returns false. The `taskRegenerate2FASecret` endpoint only checks `$user->exists()`, not `$user->authorized()`, allowing an attacker to overwrite the victim's 2FA secret with an attacker-controlled value. Additionally, this endpoint lacks CSRF protection and can be triggered via a simple GET request. An attacker with the victim's password performs: (1) password login (enters 2FA-pending state), (2) calls the unprotected regenerate endpoint to replace the victim's secret with an attacker-chosen one, (3) computes a valid TOTP using the attacker's secret, and (4) completes 2FA with that code. The victim's legitimate TOTP device is permanently locked out via permanent secret overwrite. Patched in grav-plugin-login 3.8.11 and grav 2.0.4.

## Affected products

- getgrav grav < 2.0.4
- getgrav grav-plugin-login < 3.8.11

## Identifiers

- CVE-2026-62669
- GHSA-7mgc-c7pq-3rr3

## Timeline

- 2026-06-29: disclosed: Published to GitHub Advisory Database
- 2026-09-02: patched: grav-plugin-login 3.8.11 and grav 2.0.4 released with fix
- 2026-09-02: advisory: CVE-2026-62669 / GHSA-7mgc-c7pq-3rr3 published

## References

- [https://api.github.com/users/nicl4ssic](https://api.github.com/users/nicl4ssic)
- [https://github.com/nicl4ssic](https://github.com/nicl4ssic)
- [https://api.github.com/users/nicl4ssic/gists%7B/gist_id%7D](https://api.github.com/users/nicl4ssic/gists%7B/gist_id%7D)
- [https://api.github.com/users/nicl4ssic/repos](https://api.github.com/users/nicl4ssic/repos)
- [https://avatars.githubusercontent.com/u/15530416?v=4](https://avatars.githubusercontent.com/u/15530416?v=4)
- [https://api.github.com/users/nicl4ssic/events%7B/privacy%7D](https://api.github.com/users/nicl4ssic/events%7B/privacy%7D)

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)