{"id":"CVE-2026-62669","title":"Grav Login Plugin adds login, basic ACL, and session wide messages to Grav","summary":"Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. A…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287"],"vendor":"getgrav","product":"getgrav/grav","affected":["getgrav/grav < 2.0.4"],"patched":["getgrav/grav 2.0.4"],"published":"2026-08-19","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:13:25.910","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62669","references":[{"url":"https://github.com/getgrav/grav-plugin-login/commit/5d1b722298cb947d8f434025d121b99152a2c630","label":"security-advisories@github.com"},{"url":"https://github.com/getgrav/grav-plugin-login/releases/tag/3.8.11","label":"security-advisories@github.com"},{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62669"},{"url":"https://github.com/getgrav/grav/releases/tag/2.0.4"},{"url":"https://github.com/advisories/GHSA-7mgc-c7pq-3rr3"}],"tags":["nvd","ghsa","composer"],"epss":0.00386,"epssPercentile":0.32512,"aliases":["GHSA-7mgc-c7pq-3rr3"],"ecosystem":"composer","ingestedAt":"2026-09-02T22:51:44.549Z","slug":"CVE-2026-62669","body":"## Overview\n\nGrav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-62669)\n\nAffected packages:\n\n- `getgrav/grav < 2.0.4`\n\nPatched in:\n\n- `getgrav/grav 2.0.4`\n\nSource: https://github.com/advisories/GHSA-7mgc-c7pq-3rr3","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}