CVE-2026-62232
CRITICAL
CVSS 9.1
grav
Verified Advisory
Two-factor authentication bypass in Grav CMS (CVE-2026-62232)
A two-factor authentication bypass vulnerability exists in Grav CMS where the `login.regenerate2FASecret` task checks only for user existence rather than authorization during the pending TOTP challenge window. An attacker who knows the victim's password can call this unauthenticated task to overwrite the victim's 2FA secret, derive a valid TOTP code, and complete authentication, effectively reducing the second factor to password-only protection.
Affected versions:
- 2.0.3
We recommend updating to: 2.0.4.
CVSS 9.1 · our assessment: act_now
Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3
Details: https://vuln.today/cve/CVE-2026-62232
Verified by vuln.today against published advisories.
Affected versions
- – 2.0.3
Fixed in: 2.0.4
More advisories for grav
- CVE-2026-65608 – Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)
- CVE-2026-65895 – Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)
- CVE-2026-65896 – Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)
- CVE-2026-65897 – Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)
- CVE-2026-65603 – Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
- CVE-2026-65008 – Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
- CVE-2026-65007 – Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)
- CVE-2026-62230 – Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)