Description

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T16:18:19.757Z",
  "pubdate": "2026-08-19T16:18:19.757Z",
  "executiveSummary": "An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in the Grav Login plugin prior to version 3.8.11.\nThe vulnerability affects the Grav Login plugin, specifically within the handling of the login.regenerate2FASecret task.\nAn external attacker can induce a logged-in administrative or standard user to trigger state-changing actions via malicious off-site navigation.\nSuccessful exploitation allows an attacker to overwrite a victim's Time-based One-Time Password (TOTP) secret, thereby forcing two-factor authentication re-enrollment and potentially facilitating account compromise.\nThe attack leverages standard browser session cookie behavior under a default SameSite=Lax policy.\nExploitation requires the victim to be authenticated and interacting with a malicious site while having an active session, as the vulnerable endpoint lacks anti-CSRF nonces, Origin header validation, and Referer header validation.",
  "technicalDetails": "The root cause of the vulnerability is the absence of adequate request verification mechanisms—specifically the lack of a login-form nonce, an Origin header check, and a Referer header check—within the task service provider infrastructure.\nThe vulnerable component is the TaskServiceProvider handling the task: URI parameter, specifically executing the login.regenerate2FASecret task via the taskRegenerate2FASecret() function.\nThe endpoint accepts top-level GET requests without enforcing validation to ensure the request originated from a legitimate user action within the application interface.\nUnder the default SameSite=Lax session cookie policy, cross-site navigations send authentication cookies along with top-level GET requests, permitting external sites to invoke the state-changing handler in the context of an authenticated victim's session.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious external website or link containing a reference to the vulnerable Grav application endpoint configured with the task: login.regenerate2FASecret parameter. Second, a target user who currently possesses an active session on the Grav instance visits the malicious page or clicks the crafted link. Third, the browser issues a top-level GET request to the Grav Login plugin endpoint, automatically attaching the user's valid session cookie due to the SameSite=Lax configuration. Fourth, the TaskServiceProvider processes the request, invoking the taskRegenerate2FASecret() function without verifying nonces or inspecting Origin and Referer headers. Fifth, the application overwrites the victim's existing TOTP secret on the backend, effectively breaking the current two-factor authentication configuration and forcing re-enrollment.\nThe affected versions include all releases of the Grav Login plugin prior to version 3.8.11.\nThe vulnerability requires network exposure of the Grav instance and relies on social engineering or victim browsing behavior to initiate the off-site navigation, while authentication is implicitly provided by the victim's active session."
}