CyberRota Analysis
AI-GeneratedGrav-plugin-login versions prior to 3.8.11 are vulnerable to a cross-site request forgery (CSRF) flaw that allows an attacker to regenerate a user's TOTP secret without proper anti-CSRF protections. This can lead to unauthorized 2FA re-enrollment, compromising account security for users who are tricked into visiting a malicious site. Organizations using this plugin should prioritize patching to mitigate the risk, especially if they have not configured session cookies with Strict SameSite attributes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter and the default session cookie is SameSite=Lax, an attacker can lure a logged-in victim to an off-site page that performs a top-level GET navigation, rotating the victim's TOTP secret so their enrolled authenticator no longer matches the server, effectively forcing 2FA re-enrollment. Sites configured with session.samesite: Strict are not affected.