What is the CVSS score of CVE-2026-62669?

CVE-2026-62669 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Grav Login Plugin are affected by CVE-2026-62669?

The Grav Login Plugin (versions prior to 3.8.11) contains a vulnerability that completely bypasses two-factor authentication when an attacker has a user's password, converting a compromised…. A patch is available.

How to fix or mitigate CVE-2026-62669?

Within 24 hours, inventory all Grav installations running the Login Plugin and identify which versions are deployed. Within 7 days, upgrade all instances to Grav Login Plugin version 3.8.11 or later, testing in a non-production environment first. Complete deployment across all production systems by day 30 and verify that 2FA enforcement is functioning correctly for all user accounts.

Grav Login Plugin CVE-2026-62669

EUVD-2026-62540 HIGH

Improper Authentication (CWE-287)

2026-08-19 GitHub_M

Authentication Bypass Grav Grav Plugin Login

7.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

AC:H reflects the mandatory prerequisite of possessing the victim's password; PR:N because the attacker self-authenticates using stolen credentials; A:N as no availability impact is present.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 19, 2026 - 16:38 vuln.today

Analysis Generated

Aug 19, 2026 - 16:38 vuln.today

Patch available

Aug 19, 2026 - 16:17 EUVD

CVE Published

Aug 19, 2026 - 15:40 cve.org

HIGH 7.4

DescriptionCVE.org

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.

AnalysisAI

Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must possess the target account's valid password - this is the dominant prerequisite and the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.4 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately reflects the attack profile: fully remote and requiring no interaction, but constrained by AC:H because the attacker must independently possess the victim's password. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade grav-plugin-login to version 3.8.11, available at https://github.com/getgrav/grav-plugin-login/releases/tag/3.8.11, and upgrade Grav core to version 2.0.4 or later per EUVD-2026-62540. … Detailed patch versions, workarounds, and compensating controls in full report.