CVE-2026-62669

Grav CMS's Login plugin (v3.8.10 confirmed) allows the login.regenerate2FASecret task to run during the 2FA pending-challenge window with only a user-existence check, no authorization check and no CSRF nonce, overwriting the account's stored TOTP secret on disk and returning the new secret in the JSON response. An attacker who already holds valid account credentials logs in to reach the pending-2FA state, sends a single request to the task, reads the returned secret, and computes a valid TOTP code to complete the login. This effectively reduces the second factor to password-only, granting full authenticated access to the affected account with confidentiality and integrity impact (CVSS 7.4 high). Only Grav CMS sites running the Login plugin with TOTP 2FA enabled on accounts are affected. No broad exploitation is known so far: EPSS is 0.4%, the flaw is not in CISA KEV, and no public PoC is known beyond the researcher's live confirmation on a test instance.

What to do: Upgrade the Grav CMS Login plugin to a release newer than 3.8.10 as soon as a patched version is published (the source data does not specify a fixed version). Until patched, consider disabling TOTP 2FA in the Login plugin or restricting site exposure, and review user accounts for unexpected twofa_secret changes. Because the attack requires valid credentials, enforce strong passwords and rotate any credentials suspected of being compromised.