CVE-2026-62669: Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user->exists(), not $user->authorized can be called without a CSRF nonce. It overwrites the victim’s twofa_secret on disk with an attacker-chosen value, returns the new secret in the JSON response, and the attacker computes a valid TOTP code to complete the 2FA flow. The second factor is reduced to password-only. The exploit was confirmed live after enabling 2FA to a user.
References
- github.com/advisories/GHSA-7mgc-c7pq-3rr3
- github.com/getgrav/grav-plugin-login/commit/5d1b722298cb947d8f434025d121b99152a2c630
- github.com/getgrav/grav-plugin-login/releases/tag/3.8.11
- github.com/getgrav/grav/releases/tag/2.0.4
- github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3
- nvd.nist.gov/vuln/detail/CVE-2026-62669
Code Behaviors & Features
Detect and mitigate CVE-2026-62669 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →