CVE-2026-62236: Grav Login Plugin CSRF Vulnerability

CVE-2026-62236 Overview

CVE-2026-62236 is a Cross-Site Request Forgery (CSRF) vulnerability in the grav-plugin-login component of the Grav content management system (CMS), affecting versions prior to 3.8.11. The flaw resides in the login.regenerate2FASecret frontend task, which regenerates and persists a new Time-based One-Time Password (TOTP) secret for the authenticated session user. The endpoint lacks an anti-CSRF nonce and does not validate the Origin or Referer headers. An attacker can lure an authenticated victim to an off-site page that issues a top-level GET navigation, silently rotating the victim's TOTP secret and desynchronizing their enrolled authenticator.

Critical Impact
Successful exploitation forces the victim into 2FA re-enrollment because the server-side TOTP secret no longer matches the code produced by their authenticator app.

Affected Products

Grav CMS grav-plugin-login versions prior to 3.8.11
Grav deployments using the default session.samesite: Lax cookie configuration
Grav sites with 2FA (TOTP) enabled for authenticated users

Discovery Timeline

2026-07-17 - CVE-2026-62236 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-62236

Vulnerability Analysis

The vulnerability is classified as [CWE-352] Cross-Site Request Forgery. Grav core dispatches plugin tasks from the task: URI parameter supplied via GET requests. The login.regenerate2FASecret frontend task performs a state-changing operation — generating and persisting a new TOTP secret — without requiring a CSRF token, custom header, or POST semantics.

Because the default Grav session cookie uses the SameSite=Lax attribute, cookies are automatically attached to top-level cross-site GET navigations. An attacker hosting a malicious page can therefore issue a request such as an <img>, <iframe>, or window navigation targeting the vulnerable endpoint, and the victim's browser will submit the authenticated session cookie alongside it.

The impact is limited: the attacker cannot read the new secret or authenticate as the victim. However, the victim's registered authenticator device stops producing valid codes, disrupting login and forcing manual re-enrollment through account recovery workflows.

Root Cause

The root cause is missing CSRF protection on a state-changing GET-dispatchable task. Grav's task routing accepts security-sensitive actions via the task: URI parameter, and the regenerate2FASecret handler neither enforces a nonce, validates Origin/Referer, nor requires an idempotent HTTP method. Combined with a Lax SameSite policy, the endpoint becomes reachable from any cross-origin top-level navigation.

Attack Vector

An attacker crafts a page hosted on an external domain that triggers a top-level GET navigation to the victim's Grav site with the task:login.regenerate2FASecret parameter. The victim, already authenticated to the Grav instance, visits the attacker's page through phishing or social engineering. The browser attaches the session cookie, Grav executes the task, and the server rotates the TOTP secret. The victim's authenticator app continues generating codes bound to the old secret, causing subsequent 2FA verifications to fail.

Exploitation code is not required beyond a hyperlink or auto-navigation script hosted on an attacker-controlled page. See the GitHub Security Advisory and VulnCheck Advisory for full technical details.

Detection Methods for CVE-2026-62236

Indicators of Compromise

Unexpected HTTP GET requests to Grav endpoints containing the task:login.regenerate2FASecret URI parameter.
User reports of authenticator app codes suddenly failing without administrative action.
Cross-origin Referer headers on requests targeting login.regenerate2FASecret.
Spikes in 2FA re-enrollment or account recovery requests following user traffic to external sites.

Detection Strategies

Inspect web server and application logs for GET requests carrying the task: parameter set to login.regenerate2FASecret, particularly with off-site Referer values.
Correlate TOTP secret regeneration events in Grav application logs against user-initiated 2FA management workflows to identify unattended rotations.
Alert on repeated failed 2FA attempts by users whose TOTP secret was recently modified.

Monitoring Recommendations

Ingest Grav access and application logs into a centralized analytics or SIEM platform and build detections for the regenerate2FASecret task pattern.
Monitor for unusual clustering of TOTP re-enrollment events across the user base, which may indicate mass exploitation attempts.
Track outbound referrers to the Grav login domain to identify malicious lure pages targeting authenticated users.

How to Mitigate CVE-2026-62236

Immediate Actions Required

Upgrade grav-plugin-login to version 3.8.11 or later, which introduces CSRF protections on the regenerate2FASecret task.
Set session.samesite: Strict in the Grav system configuration to block cross-site cookie attachment on top-level GET navigations.
Audit recent TOTP secret regeneration events and require re-enrollment verification for any that appear unattended.

Patch Information

The issue is resolved in grav-plugin-login version 3.8.11. Administrators should update the plugin through the Grav Package Manager (GPM) or by replacing the plugin directory with the fixed release. Refer to the GitHub Security Advisory GHSA-4px8-7p53-282r for release notes.

Workarounds

Configure session.samesite: Strict in system.yaml if immediate patching is not possible; sites with this setting are not affected.
Restrict access to authenticated Grav interfaces behind a VPN or IP allowlist to reduce exposure to cross-site lures.
Educate administrators and privileged users about phishing links that may target authenticated CMS sessions.

bash

# Configuration example: enforce Strict SameSite in Grav system.yaml
session:
  enabled: true
  timeout: 1800
  name: grav-site
  secure: true
  httponly: true
  samesite: Strict