CVE-2026-62671

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-62671

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62671.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-62671

Aliases

GHSA-4px8-7p53-282r

Published

2026-08-19T15:49:40Z

Modified

2026-09-11T03:30:36Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVSS Calculator

Summary

CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)

Details

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-352"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62671.json"
}

References

Affected packages

Git / github.com/getgrav/grav-plugin-login

Affected ranges

Type

GIT

Repo

https://github.com/getgrav/grav-plugin-login

Events

Introduced

Fixed

5d1b722298cb947d8f434025d121b99152a2c630

Fixed

0166e334966bf180d735fd2bb2e4b76fb7d63030

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.8.11"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.3.1

0.3.2

0.3.3

1.*

1.0.0

1.0.1

1.1.0

1.2.0

1.2.1

1.3.0

1.3.1

2.*

2.0.0

2.0.0-beta.1

2.0.0-beta.3

2.0.0-rc.1

2.0.0-rc.2

2.0.1

2.1.0

2.1.0-rc.1

2.1.0-rc.2

2.1.1

2.1.2

2.2.0

2.2.0-rc.1

2.2.0-rc.2

2.2.0-rc.3

2.2.0-rc.5

2.2.1

2.3.0

2.3.1

2.3.2

2.4.0

2.4.1

2.4.2

2.4.3

2.5.0

2.6.0

2.6.1

2.6.2

2.6.3

2.7.0

2.7.1

2.7.2

2.7.3

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

3.*

3.0.0

3.0.0-beta.1

3.0.0-rc.1

3.0.0-rc.2

3.0.0-rc.3

3.0.0-rc.4

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.1.0

3.2.0

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.7

3.3.8

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.5.0

3.5.1

3.5.2

3.5.3

3.6.0

3.6.1

3.6.2

3.6.3

3.7.0

3.7.1

3.7.2

3.7.3

3.7.4

3.7.5

3.7.6

3.7.7

3.7.8

3.7.8.1

3.7.9

3.8.0

3.8.1

3.8.10

3.8.2

3.8.3

3.8.4

3.8.5

3.8.6

3.8.7

3.8.8

3.8.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62671.json"