CVE-2026-62236

The record

grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter and the default session cookie is SameSite=Lax, an attacker can lure a logged-in victim to an off-site page that performs a top-level GET navigation, rotating the victim's TOTP secret so their enrolled authenticator no longer matches the server, effectively forcing 2FA re-enrollment. Sites configured with session.samesite: Strict are not affected.

Affected packages

Related vulnerabilities

• CVE-2026-110288 A cross-site request forgery vulnerability was identified in GitHub Enterprise Server… CWE-352
• CVE-2026-63433 MyTube is a self-hosted downloader and player for several video websites. CWE-352
• CVE-2026-121451 AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in… CWE-352
• CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5… CWE-352
• CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request… CWE-352
• CVE-2026-120206 Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back… CWE-352
• CVE-2026-120207 Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that… CWE-352
• CVE-2026-61826 Bazarr is a companion application to Sonarr and Radarr. CWE-352