Two-factor authentication bypass in Grav CMS (CVE-2026-62232)

A two-factor authentication bypass vulnerability exists in Grav CMS where the `login.regenerate2FASecret` task checks only for user existence rather than authorization during the pending TOTP challenge window. An attacker who knows the victim's password can call this unauthenticated task to overwrite the victim's 2FA secret, derive a valid TOTP code, and complete authentication, effectively reducing the second factor to password-only protection. Affected versions: - 2.0.3 We recommend updating to: 2.0.4. CVSS 9.1 · our assessment: act_now Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3 Details: https://vuln.today/cve/CVE-2026-62232