CVE-2026-62671 Cross-site request forgery in grav-plugin-login
An anonymous attacker can force a logged-in user to reset their 2FA secret via CSRF, bypassing two-factor authentication protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-62671?
CVE-2026-62671 is a medium-severity vulnerability in getgrav grav-plugin-login, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
Weakness: CWE-352
Which versions are affected by CVE-2026-62671?
How do I fix CVE-2026-62671?
No fix has been published for CVE-2026-62671 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-62671 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62671 exists.
Sources
Also known as GHSA-4px8-7p53-282r.