CVE-2026-62232 affects Grav before version 2.0.4. The vulnerability lies in the login plugin's regenerate2FASecret task, which fails to enforce proper authorization checks during the pending TOTP challenge window. This allows an attacker with knowledge of a victim's password to call this task without a CSRF nonce, overwrite the victim's two-factor authentication secret with an attacker-controlled value, compute a valid TOTP code, and bypass the intended 2FA protection. This reduces the security of the authentication process to relying solely on the password.

Successful exploitation allows attackers who know a victim's password to bypass two-factor authentication by resetting the victim's 2FA secret to an attacker-chosen value. This compromises the multi-factor authentication mechanism, effectively reducing account security to password-only protection and increasing the risk of unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the regenerate2FASecret task, monitor for suspicious activity involving 2FA secret regeneration, and enforce strong password policies. Avoid using affected versions and upgrade promptly once a patch is released.