https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 04:51:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-62671 <p><strong>Affected:</strong> getgrav grav-plugin-login</p> <p>Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim&#39;s session, overwrite the victim&#39;s TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.</p> <p><strong>Affected:</strong> getgrav grav-plugin-login</p> <p>Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim&#39;s session, overwrite the victim&#39;s TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.</p> https://vulnerability.circl.lu/vuln/cve-2026-62671