EUVD-2026-62544

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

PT-2026-78487

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The login.regenerate2FASecret task fails to verify if a user is authorized, checking only for the existence of a pending-session user. An attacker who has obtained a victim's password can...