Grav Login Plugin CVE-2026-62671

The victim must have an active, valid Grav Login Plugin session cookie under the browser-default SameSite=Lax cookie policy. The attack is triggered exclusively via a top-level cross-site GET navigation (link click or redirect) - the only cross-site request type SameSite=Lax permits to carry session cookies; cross-site fetch or XHR requests would be blocked. Two-factor authentication must be enabled and the victim must be a logged-in Grav user (PR:N refers to the attacker requiring no privileges, not the victim being unauthenticated). A secondary path exists for sessions in the mid-login 2FA challenge state (authenticated but not yet authorized), exploitable by an attacker with precise timing. Exploitation is limited by the mandatory user interaction requirement: the victim must actively click a crafted link during an authenticated session, making mass automated exploitation infeasible. No non-default server configuration is required.

The CVSS 3.1 score of 5.4 (Medium, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) accurately reflects the attack profile: network-delivered, low complexity, no attacker privileges, but requiring user interaction. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been identified, making mass exploitation unlikely at this time. The real-world impact, while not catastrophic, is operationally disruptive: a victim's existing TOTP authenticator app is silently invalidated, locking them out of 2FA-protected Grav admin access until they complete re-enrollment. For sites where the administrator is the sole account, this could function as an account destabilization primitive. The UI:R requirement is the primary exploitation brake - each attack requires social engineering of an individually targeted, currently authenticated user. The secondary authorization bypass (exists() without authorized check) slightly elevates risk for targeted attacks timed to a victim's active login flow. Overall, this is a genuine medium-priority issue warranting prompt patching but not emergency response in most deployments.

An attacker identifies a Grav site administrator and sends them a phishing email or social media message containing a disguised link that resolves to the Grav admin's regenerate2FASecret GET endpoint. When the administrator clicks the link from a browser with an active Grav session, SameSite=Lax transmits the session cookie to the target server, invoking taskRegenerate2FASecret() in the victim's session and silently overwriting their TOTP secret. The administrator's existing authenticator app becomes invalid at next login, forcing re-enrollment and potentially creating a window - if the attacker can observe the QR code display on the admin's screen or redirect the page - to enroll an attacker-controlled device.