https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:33:44 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-62669 <p>Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-&gt;authorized. After submitting a victim&#39;s correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim&#39;s second factor. This issue is fixed in version 3.8.11.</p> <p>Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-&gt;authorized. After submitting a victim&#39;s correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim&#39;s second factor. This issue is fixed in version 3.8.11.</p> https://db.gcve.eu/vuln/fkie_cve-2026-62669 https://db.gcve.eu/vuln/ghsa-7mgc-c7pq-3rr3 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the `login.regenerate2FASecret` task which requires only `$user-&gt;exists()`, not `$user-&gt;authorized` can be called without a CSRF nonce. It overwrites the victim&#39;s `twofa_secret` on disk with an attacker-chosen value, returns the new secret in the JSON response, and the attacker computes a valid TOTP code to complete the 2FA flow. The second factor is **reduced to password-only**. The exploit was confirmed live after enabling 2FA to a user.</p> <p>### Details Four code locations in login plugin v3.8.10 enable the chain:</p> <p>**1. Session user set even with 2FA pending** `user/plugins/login/login.php` - `userLogin()` assigns `$session-&gt;user = $user` before TOTP verification completes. This makes `$this-&gt;grav[&#39;user&#39;]` point to the victim in the pending-challenge window.</p> <p>**2. `taskRegenerate2FASecret` - no authorization check** `user/plugins/login/classes/Controller.php`</p> <p>```php public function taskRegenerate2FASecret() { $user = $this-&gt;grav[&#39;user&#39;]; if ($user-&gt;exists()) { // ← only checks exists(), NOT authorized() $secret = $twoFa-&gt;createSecret(); $user-&gt;twofa_secret = $secret; // overwrites victim&#39;s secret on disk $user-&gt;save(); $json_response = [ &#39;status&#39; =&gt; &#39;success&#39;, &#39;image&#39; =&gt; $image, &#39;se…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the `login.regenerate2FASecret` task which requires only `$user-&gt;exists()`, not `$user-&gt;authorized` can be called without a CSRF nonce. It overwrites the victim&#39;s `twofa_secret` on disk with an attacker-chosen value, returns the new secret in the JSON response, and the attacker computes a valid TOTP code to complete the 2FA flow. The second factor is **reduced to password-only**. The exploit was confirmed live after enabling 2FA to a user.</p> <p>### Details Four code locations in login plugin v3.8.10 enable the chain:</p> <p>**1. Session user set even with 2FA pending** `user/plugins/login/login.php` - `userLogin()` assigns `$session-&gt;user = $user` before TOTP verification completes. This makes `$this-&gt;grav[&#39;user&#39;]` point to the victim in the pending-challenge window.</p> <p>**2. `taskRegenerate2FASecret` - no authorization check** `user/plugins/login/classes/Controller.php`</p> <p>```php public function taskRegenerate2FASecret() { $user = $this-&gt;grav[&#39;user&#39;]; if ($user-&gt;exists()) { // ← only checks exists(), NOT authorized() $secret = $twoFa-&gt;createSecret(); $user-&gt;twofa_secret = $secret; // overwrites victim&#39;s secret on disk $user-&gt;save(); $json_response = [ &#39;status&#39; =&gt; &#39;success&#39;, &#39;image&#39; =&gt; $image, &#39;se…</p> https://db.gcve.eu/vuln/ghsa-7mgc-c7pq-3rr3