High 7.4Published Aug 19, 2026

CVE-2026-62669Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Updated under an hour ago (2026-10-19 08:10 UTC)

Does this affect you?

It affects getgrav grav and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for getgrav grav

Exploited in the last 30 days

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-287
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Aug 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

getgrav grav getgrav:grav (from the name)	before 2.0.4	CNA record
getgrav grav-plugin-login getgrav:grav_plugin_login (from the name)	before 3.8.11	CNA record

References

https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3x-refsource-confirm
https://github.com/getgrav/grav-plugin-login/commit/5d1b722298cb947d8f434025d121b99152a2c630x-refsource-misc
https://github.com/getgrav/grav-plugin-login/releases/tag/3.8.11x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.