CVE-2026-62232

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4

Description A two-factor authentication bypass exists in the login plugin. The regenerate2FASecret task fails to verify authorization during the pending TOTP (Time-based One-Time Password) challenge window, checking only if the user exists. An attacker possessing the victim's password can invoke this task without a CSRF nonce to replace the 2FA secret with a value of their choice. This allows the attacker to generate a valid TOTP code and complete the authentication process, effectively reducing the security of the account to password-only protection.

Recommendations Update Grav to version 2.0.4 or later. As a temporary mitigation, restrict access to the regenerate2FASecret task.