Is CVE-2026-62669 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-62669?

CVE-2026-62669 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-62669

Description

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.