CVE-2026-62669 in Grav Login 3.x allows an attacker with valid credentials to regenerate a TOTP secret during the pending 2FA challenge state, receiving the new secret in the response while leaving the victim's original secret still functional. This creates silent persistence: the victim can log in normally from their own device while the attacker independently possesses a working second factor. For admin accounts, this vulnerability chains directly to RCE through plugin/theme management access.
The core issue is not a missing authorization check—it's a design flaw where the pending TOTP state is implicitly trusted as 'authenticated enough' to perform security-critical operations. The patch in version 3.8.11 adds an authorized check to taskRegenerate2FASecret(), but this likely leaves other TOTP-related tasks in the pending window (taskVerify2FASecret(), taskDisable2FA()) with identical gaps. The pending-state authorization architecture needs systematic review, not individual function patches.
Check your Grav version immediately. If you're below 3.8.11, upgrade and assume potential compromise. The critical question is whether the fix also invalidates previously regenerated secrets server-side—if it only adds the authorization gate without rotating the secret binding, an attacker who exploited this before patching still retains a working TOTP factor. Audit your user database for accounts where 2FA enrollment dates don't match expected timelines, and consider forcing re-enrollment for all admin accounts as a precautionary measure.
The EPSS score of 0.00386 is misleading for targeted attacks. Once this CVE is public, automated scanners will identify vulnerable Grav instances within 72 hours. The window between disclosure and patch propagation is when mass exploitation occurs, not sophisticated credentialed attacks.