Grav CMS 2FA Bypass Flaw Discovered

A newly disclosed security vulnerability affecting Grav content management systems exposes a significant weakness in the platform's authentication process. Identified as CVE-2026-62232, the flaw centers on how the login plugin handles two-factor authentication (2FA) requests.

The Mechanics of the Bypass

The vulnerability exists within the regenerate2FASecret task of the Grav login plugin. Under normal operation, this task is intended to assist with managing 2FA secrets. However, the system currently performs a check only for user existence rather than verifying proper authorization when a user is in a pending TOTP challenge window.

An attacker who has already obtained the victim's password can exploit this oversight. By calling the task without the required CSRF nonce, an unauthorized user can overwrite the existing 2FA secret with a value they have chosen. This action effectively allows the attacker to generate a valid TOTP code themselves, successfully completing the authentication process.

Technical Severity and Impact

The issue is classified as having a critical severity rating. The specific failure point is that the mechanism fails to validate the authorization status of the user during the sensitive period when the system expects a secondary authentication factor, ultimately reducing the security of the account to mere password-only protection.

• Advisory ID: GHSA-4m9m-rmh9-2pgf
• Affected Version: Grav before 2.0.4
• CVSS Score: 7.4

Implications for Security Integrity

This vulnerability highlights a specific failure in access control validation during the authentication lifecycle. Because the exploit relies on the ability to call the regenerate2FASecret task without a CSRF nonce, the integrity of the 2FA process is compromised once a primary password is known. Maintaining software currency is essential to address the logic error present in versions prior to 2.0.4.