CyberRota Analysis
AI-GeneratedA vulnerability in the Grav CMS prior to version 2.0.4 allows attackers to bypass two-factor authentication by exploiting the login plugin, which only verifies user existence without proper authorization during the TOTP challenge. This enables an attacker with knowledge of the victim's password to overwrite the 2FA secret, effectively reducing the security to password-only protection. Organizations using Grav should prioritize updating to the latest version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF nonce to overwrite the 2FA secret with an attacker-chosen value, compute a valid TOTP code, and complete authentication while reducing 2FA to password-only protection.