Description
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim-s session, overwrite the victim-s TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
CVSS 5.4EPSS 0.136%Risk 0.55
View source- Published
- 2026-08-19 16:18:19
- Affected versions
- <3.8.11
- Type
- Library
- Last modified
- 2026-08-19 17:19:54
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L