Description

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T16:18:19.460Z",
  "pubdate": "2026-08-19T16:18:19.460Z",
  "executiveSummary": "An authentication bypass vulnerability exists in the Grav Login plugin prior to version 3.8.11, specifically within the login.regenerate2FASecret task. The flaw permits an unauthenticated or partially authenticated attacker to subvert multi-factor authentication mechanisms during the login sequence. By exploiting insufficient authorization checks during the pending Time-based One-Time Password (TOTP) challenge state, an attacker who supplies a victim's correct password can overwrite the existing two-factor authentication secret. The replacement secret is subsequently disclosed in the server response, enabling the adversary to compute a valid verification code and successfully authenticate as the victim without possessing their second factor. This compromises account integrity and bypasses mandatory security controls across affected Grav CMS deployments.",
  "technicalDetails": "The vulnerability resides in the Grav Login plugin, which manages authentication, basic access control lists, and session-wide messaging for Grav. The specific vulnerable component is the login.regenerate2FASecret task handler, implemented via the taskRegenerate2FASecret() function. The root cause of the vulnerability is an inadequate authorization validation check prior to executing the secret regeneration logic. Instead of enforcing a strict verification that checks $user->authorized, the function merely validates the existence of a pending-session user.\nThe exploitation flow proceeds as follows. First, an attacker initiates a login attempt for a target victim account, providing the victim's correct account password. Upon successful validation of the primary credentials, the application transitions the session into a pending TOTP challenge state, awaiting a valid second-factor code. At this juncture, rather than supplying a TOTP code, the attacker invokes the vulnerable taskRegenerate2FASecret() method. Because the application fails to verify the $user->authorized flag during this pending state, the backend processes the request and overwrites the existing two-factor secret (twofa_secret) associated with the victim's user profile.\nCrucially, the application returns the newly generated replacement secret directly within the server's HTTP response. Armed with this newly exposed secret, the attacker can locally calculate a valid TOTP verification code. Finally, the attacker submits this calculated code to complete the authentication sequence, effectively bypassing the victim's second-factor authentication entirely and gaining unauthorized access to the victim's account and associated privileges within the Grav platform. The vulnerability affects all Grav Login plugin versions prior to 3.8.11."
}