CVE-2026-62671

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11

Description The Grav Login plugin allows a top-level GET request to be sent to the task URI parameter via the TaskServiceProvider without requiring a login-form nonce, an Origin check, or a Referer check. This allows an attacker to trigger the taskRegenerate2FASecret() function in the session of a logged-in user through off-site navigation. This action overwrites the victim's Time-based One-Time Password (TOTP) secret, which is a temporary password that changes every 30 seconds, forcing the user to re-enroll their two-factor authentication.

Recommendations Update Grav Login Plugin to version 3.8.11.