CVE-2026-62669

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11

Description The login.regenerate2FASecret task fails to verify if a user is authorized, checking only for the existence of a pending-session user. An attacker who has obtained a victim's password can invoke the taskRegenerate2FASecret() function during the Time-based One-Time Password (TOTP) challenge. This allows the attacker to overwrite the twofa secret variable, retrieve the new secret from the response, and generate a valid code to bypass the second factor authentication.

Recommendations Update Grav Login Plugin to version 3.8.11.