Is there a patch available for CVE-2026-62236?

Yes, a patch is available for CVE-2026-62236. Update the affected software to the latest version immediately.

Grav Login Plugin CVE-2026-62236

Q: What is the CVSS score of CVE-2026-62236?

CVE-2026-62236 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-45082 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-17 VulnCheck

GHSA-f4c6-8fcq-j58x

CSRF Grav

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

UI:R required as victim must navigate; PR:N since attacker holds no account; C:N as no data is exposed; I:L and A:L for TOTP invalidation impact only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:02 vuln.today

DescriptionCVE.org

grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter and the default session cookie is SameSite=Lax, an attacker can lure a logged-in victim to an off-site page that performs a top-level GET navigation, rotating the victim's TOTP secret so their enrolled authenticator no longer matches the server, effectively forcing 2FA re-enrollment. Sites configured with session.samesite: Strict are not affected.

AnalysisAI

CSRF in grav-plugin-login before 3.8.11 allows a remote unauthenticated attacker to rotate a logged-in victim's TOTP secret by luring them to an attacker-controlled page that performs a top-level GET navigation to the Grav site's regenerate2FASecret task endpoint. Because Grav dispatches frontend tasks via GET URI parameters and the default SameSite=Lax session cookie policy permits cross-origin top-level GET navigations to carry cookies, the victim's authenticator app is silently invalidated, forcing 2FA re-enrollment - though the attacker gains no account access. No public exploit has been identified at time of analysis; CVSS 4.0 score is 2.3, reflecting genuinely low severity.

Technical ContextAI

Grav CMS uses a flat-file architecture and dispatches frontend task actions through the GET 'task:' URI parameter (e.g., ?task=login.regenerate2FASecret), which makes all such task endpoints inherently reachable via browser navigation. The grav-plugin-login component handles TOTP-based two-factor authentication enrollment, including a task that regenerates and persists a new TOTP shared secret to the authenticated user's profile. The root cause is CWE-352 (Cross-Site Request Forgery): the regenerate2FASecret handler performs a server-side state change without validating any anti-CSRF nonce, nor does it inspect Origin or Referer headers to confirm the request originated from the same site. The browser's SameSite=Lax default cookie policy is the key enabler - Lax permits session cookies to be attached to cross-origin top-level GET navigations (link clicks, window.location assignments), so a victim's session is indistinguishable from an intentional self-request when navigating from an attacker page. The CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* covers all Grav versions prior to the plugin fix at 3.8.11.

RemediationAI

Upgrade grav-plugin-login to version 3.8.11 or later, which is the vendor-released patch confirmed by the security advisory at https://github.com/getgrav/grav/security/advisories/GHSA-4px8-7p53-282r. For sites that cannot immediately update, setting session.samesite=Strict in the Grav site configuration is an effective compensating control that completely blocks this attack by preventing the browser from sending session cookies on any cross-origin navigation - note that this may break legitimate cross-site login redirects or SSO flows if your deployment relies on them, so evaluate the trade-off before applying. No other specific workarounds are documented in available references.