Grav Plugin Login
Monthly
Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.
Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack primitive is explicitly confirmed by vendor advisory GHSA-7mgc-c7pq-3rr3 and the commit diff.
Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.
Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack primitive is explicitly confirmed by vendor advisory GHSA-7mgc-c7pq-3rr3 and the commit diff.