CVE-2026-62669

creationtimestamp| type| source ---|---|--- 2026-09-02 23:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mul3p4uzs42m 2026-09-03 00:35:07+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3 2026-09-03 14:32:32+00:00|...

CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-62669

Grav Login Plugin (for Grav CMS) prior to 3.8.11 contains a two-factor authentication bypass in the login.regenerate2FASecret task. The root cause is an insufficient authorization check: the task verifies only that the pending-session user exists rather than requiring $user->authorized. An att...