CVE-2026-62236 Details
Description
grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter and the default session cookie is SameSite=Lax, an attacker can lure a logged-in victim to an off-site page that performs a top-level GET navigation, rotating the victim's TOTP secret so their enrolled authenticator no longer matches the server, effectively forcing 2FA re-enrollment. Sites configured with session.samesite: Strict are not affected.
A cross-site request forgery (CSRF) vulnerability has been identified in the Grav plugin for login, affecting versions prior to 3.8.11. The issue arises in the 'login.regenerate2FASecret' frontend task, which allows for the regeneration and persistence of a new TOTP secret for the user currently logged in, without any anti-CSRF nonce or Origin/Referer check. This vulnerability can be exploited by luring a logged-in user to an off-site page that performs a top-level GET navigation, using the default session cookie setting of SameSite=Lax. As a result, the user's TOTP secret is rotated, causing a desynchronization with their authenticator app and effectively forcing a re-enrollment in two-factor authentication. However, sites with the session.samesite setting configured to Strict are not vulnerable.
Users can update to Grav Plugin Login version 3.8.11 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-4px8-7p53-282r | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-4px8-7p53-282r | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/grav-plugin-login-csrf-via-regenerate2fasecret | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Plugin Login | <= 3.8.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |