CVE-2026-62236

Name of the Vulnerable Software and Affected Versions grav-plugin-login versions prior to 3.8.11

Description A cross-site request forgery (CSRF) issue exists in the login.regenerate2FASecret frontend task. The system regenerates and persists a new Time-based One-Time Password (TOTP) secret for the authenticated session user without implementing an anti-CSRF nonce or Origin/Referer checks. Since the Grav core dispatches the task via the task: URI parameter and the default session cookie uses SameSite=Lax, an attacker can trick a logged-in user into visiting a malicious off-site page. This action triggers a top-level GET navigation that rotates the user's TOTP secret, causing the enrolled authenticator to mismatch the server and forcing the user to re-enroll in two-factor authentication (2FA). This issue does not affect sites configured with session.samesite: Strict.

Recommendations Update grav-plugin-login to version 3.8.11 or later. Configure session.samesite to Strict to prevent the exploitation of this issue.