Grav Login Plugin Vulnerability Allows Two-Factor Authentication Bypass
A critical flaw in Grav versions before 2.0.4 permits attackers to bypass two-factor authentication by overwriting existing security secrets.
Grav versions prior to 2.0.4 are affected by a critical vulnerability, tracked as CVE-2026-62232, within the login plugin. The issue exists in the regenerate2FASecret task, which fails to verify user authorization during the pending TOTP challenge window, checking only for user existence.
An attacker who possesses a victim's password can exploit this flaw by calling the task without a CSRF nonce to overwrite the 2FA secret with a value of their choosing. This allows the attacker to generate a valid TOTP code and complete the authentication process, effectively reducing the security of the account to password-only protection.
Users of the Grav platform are advised to update to version 2.0.4 or later to address this vulnerability and restore proper two-factor authentication security.
Sources
- GitHub Security Advisories Original source
Continue Reading
SecurityNewA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.