Executive brief
The Grav Login plugin manages user authentication and two-factor authentication for Grav CMS. A cross-site request forgery (CSRF) vulnerability in the 2FA secret regeneration feature allows an attacker to trick a logged-in user into visiting a malicious webpage that silently resets the user's two-factor secret, forcing them to re-enroll in 2FA and potentially allowing unauthorized account access if the attacker also knows the user's password.
Technical details
The login.regenerate2FASecret task in the Grav Login plugin prior to version 3.8.11 accepts GET requests to a TaskServiceProvider URI without requiring a login-form nonce, Origin check, or Referer check. Under the default SameSite=Lax session cookie policy, an attacker can craft a webpage that issues a cross-site GET request to trigger taskRegenerate2FASecret() in a victim's authenticated session, overwriting their TOTP secret. The fix requires POST requests with a valid login-form nonce and a fully authorized session (blocking the 2FA-pending challenge window), preventing both CSRF attacks and second-factor bypass during enrollment.
Affected products
- Getgrav Login Plugin prior to 3.8.11
Timeline
- 2026-08-19: disclosed
- 2026-06-29: patched