CVE-2026-62232
Grav versions prior to 2.0.4 contain a flaw in the login plugin’s regenerate2FASecret task that only verifies a user exists, not that the requester is authorized. An attacker who knows the victim’s password can invoke this task without a CSRF nonce, replace the 2FA secret with a value of their choosing, generate a valid TOTP code, and log in, effectively reducing two‑factor authentication to password‑only protection.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Grav CMS installations running versions earlier than 2.0.4.
Real-world impact
An attacker with the victim’s password can bypass two‑factor authentication and gain full access to the account.
Why this severity
The vulnerability is rated critical (CVSS 9.1) because it allows remote, unauthenticated attackers to defeat a key security control with only the password.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources