CVE-2026-62236 grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret
Attackers can force logged-in Grav users to reset their 2FA secrets via CSRF, disrupting authentication and requiring re-enrollment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-62236?
CVE-2026-62236 is a low-severity vulnerability in getgrav grav, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter and the default session cookie is SameSite=Lax, an attacker can lure a logged-in victim to an off-site page that performs a top-level GET navigation, rotating the victim's TOTP secret so their enrolled authenticator no longer matches the server, effectively forcing 2FA re-enrollment. Sites configured with session.samesite: Strict are not affected.
Weakness: CWE-352
Which versions are affected by CVE-2026-62236?
How do I fix CVE-2026-62236?
No fix has been published for CVE-2026-62236 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-62236 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62236 exists.
Sources
Also known as GHSA-f4c6-8fcq-j58x.