Grav Login Plugin CVE-2026-62236

The victim must be actively authenticated to the Grav site with a valid session cookie at the time of the attack. The target site must be configured with the default session.samesite=Lax cookie policy - any site that has explicitly set session.samesite=Strict is not affected, as stated in the CVE description. The exploit requires top-level GET navigation from the attacker's page (e.g., link click or redirect), not a subresource request like an img or script tag, because SameSite=Lax only attaches cookies for top-level navigations. The victim must have 2FA/TOTP enrollment active for the disruption to have meaningful impact. The attack does not grant the attacker any account credentials, session tokens, or access - it solely invalidates the victim's TOTP enrollment.

The CVSS 4.0 score of 2.3 accurately reflects the bounded real-world risk. The vector AV:N/AC:L/AT:P/PR:N/UI:P identifies two meaningful constraints: AT:P (the victim must be logged in and the site must use default SameSite=Lax cookies, not Strict) and UI:P (the victim must perform a top-level navigation from an attacker-controlled context). The impact metrics VC:N/VI:L/VA:L confirm the attack does not expose credentials, session tokens, or other confidential data - it disrupts TOTP enrollment, which is a nuisance-class availability and integrity impact. No CISA KEV listing and no public exploit code have been identified, so there is no evidence of active exploitation. The vulnerability is genuine but low-priority: it requires social engineering a logged-in user, cannot be automated en masse through passive subresource injection (img/script tags do not trigger Lax cookie sending), and delivers a disruptive rather than compromising outcome. The explicit vendor confirmation that SameSite=Strict configurations are unaffected provides a clear compensating control for risk-conscious operators.

An attacker hosts a web page that automatically redirects visitors to a URL such as https://target-grav-site.com/?task=login.regenerate2FASecret via a standard HTML link or JavaScript window.location assignment. When a user who is currently logged in to the Grav site visits the attacker's page and triggers this top-level GET navigation, the browser attaches the victim's session cookie under the default SameSite=Lax policy, causing the Grav server to execute the TOTP secret rotation in the victim's authenticated session. The victim's TOTP authenticator app immediately begins generating codes that no longer match the newly rotated server-side secret, locking the victim out of 2FA-protected access.