CyberRota Analysis
AI-GeneratedThe Grav Login Plugin prior to version 3.8.11 is vulnerable to an attack that allows an unauthenticated user to exploit the login.regenerate2FASecret task via a crafted GET request, potentially compromising a logged-in user's two-factor authentication (2FA) setup. This could lead to unauthorized access as the attacker can overwrite the victim's TOTP secret, forcing them to re-enroll in 2FA. Organizations using this plugin should prioritize updating to version 3.8.11 to mitigate the risk of session hijacking and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.