DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-62669: CVE-2026-62669: Critical Two-Factor Authentication Bypass in Grav CMS Login Plugin

#security #cve #cybersecurity

CVE-2026-62669: Critical Two-Factor Authentication Bypass in Grav CMS Login Plugin

Vulnerability ID: CVE-2026-62669
CVSS Score: 7.4
Published: 2026-09-02

CVE-2026-62669 is a critical Improper Authentication vulnerability (CWE-287) in the Grav Login Plugin for Grav CMS. Prior to version 3.8.11, the plugin's key rotation task failed to verify if a user session was fully authorized before regenerating and returning two-factor authentication (2FA) secrets. Consequently, an attacker possessing a victim's primary credentials could invoke this endpoint to replace the 2FA secret, retrieve the replacement, and bypass the MFA constraint entirely.

TL;DR

A logical validation flaw in the Grav Login Plugin allows an attacker with valid primary credentials to out-of-band regenerate and read the victim's 2FA secret, successfully bypassing multi-factor protection.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-287
  • Attack Vector: Network
  • CVSS Score: 7.4 (High)
  • EPSS Score: 0.00386
  • Impact: Two-Factor Authentication Bypass
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Grav CMS Core
  • Grav Login Plugin
  • grav-plugin-login: < 3.8.11 (Fixed in: 3.8.11)
  • grav: < 2.0.4 (Fixed in: 2.0.4)

Code Analysis

Commit: 5d1b722

Improve 2FA secret regeneration authentication and enforce CSRF nonce checking

Mitigation Strategies

  • Upgrade the Grav Login Plugin to version 3.8.11 or higher.
  • Upgrade Grav CMS Core to version 2.0.4 or higher.
  • Deploy WAF rules to restrict access to the task:login.regenerate2FASecret endpoint.

Remediation Steps:

  1. Navigate to the Grav CMS administration panel.
  2. Access the 'Plugins' management tab.
  3. Locate the 'Login' plugin and trigger the update action to retrieve version 3.8.11.
  4. If utilizing command-line administration, execute: bin/gpm update login
  5. Verify the update succeeded and test login flows to ensure session state persists properly.

References

Read the full report for CVE-2026-62669 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)