{"metadata": {"vulnerability": "CVE-2026-62669", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-14T20:22:04.394Z", "date_only": false, "value": "2026-07-14T20:22:04.394Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-62669", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-19T15:40:03.252Z", "date_only": false, "value": "2026-08-19T15:40:03.252Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-62669", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-19T15:40:03.252Z", "date_only": false, "value": "2026-08-19T15:40:03.252Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-62669", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-19T16:18:19Z", "date_only": false, "value": "2026-08-19T16:18:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7MGC-C7PQ-3RR3", "record": "GHSA-7MGC-C7PQ-3RR3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-19T16:18:19.460Z", "date_only": false, "value": "2026-08-19T16:18:19.460", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-62669", "record": "FKIE_CVE-2026-62669", "field": "published"}, {"timestamp": "2026-08-19T18:16:05.801Z", "date_only": false, "value": "2026-08-19T18:16:05.801751Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-62669", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-19T18:16:05.801Z", "date_only": false, "value": "2026-08-19T18:16:05.801751Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-62669", "record": "FKIE_CVE-2026-62669", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-19T18:18:46.380Z", "date_only": false, "value": "2026-08-19T18:18:46.380Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-62669", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-19T18:18:46.380Z", "date_only": false, "value": "2026-08-19T18:18:46.380Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-62669", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-02T22:01:25Z", "date_only": false, "value": "2026-09-02T22:01:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7MGC-C7PQ-3RR3", "record": "GHSA-7MGC-C7PQ-3RR3", "field": "published"}, {"timestamp": "2026-09-02T22:01:25Z", "date_only": false, "value": "2026-09-02T22:01:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7MGC-C7PQ-3RR3", "record": "GHSA-7MGC-C7PQ-3RR3", "field": "modified"}, {"timestamp": "2026-09-02T23:30:04.976Z", "date_only": false, "value": "2026-09-02T23:30:04.976940Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mul3p4uzs42m", "record": "CVE-2026-62669", "field": "creation_timestamp", "uuid": "ebf153ff-ba32-4fba-8d93-dc3f13c0c60d", "content": "CVE-2026-62669 - grav\nAn outdated version of the Grav Login Plugin allows attackers to bypass two-factor authentication. This means an attacker can log in without the second security code, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mul3p4uzs42m"}, {"timestamp": "2026-09-03T00:35:07.237Z", "date_only": false, "value": "2026-09-03T00:35:07.237881Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3", "record": "CVE-2026-62669", "field": "creation_timestamp", "uuid": "9c0114d3-fe7b-471e-a400-d81c53baf255", "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3"}, {"timestamp": "2026-09-03T14:32:32.686Z", "date_only": false, "value": "2026-09-03T14:32:32.686913Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/fb22df514827698e37bf556e10bb1199", "record": "CVE-2026-62669", "field": "creation_timestamp", "uuid": "b19057cc-1fed-42f6-875e-3f296cbf04b7", "content": "# CVE-2026-62669: CVE-2026-62669: Critical Two-Factor Authentication Bypass in Grav CMS Login Plugin\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62669\n\n## Summary\nCVE-2026-62669 is a critical Improper Authentication vulnerability (CWE-287) in the Grav Login Plugin for Grav CMS. Prior to version 3.8.11, the plugin's key rotation task failed to verify if a user session was fully authorized before regenerating and returning two-factor authentication (2FA) secrets. Consequently, an attacker possessing a victim's primary credentials could invoke this endpoint to replace the 2FA secret, retrieve the replacement, and bypass the MFA constraint entirely.\n\n## TL;DR\nA logical validation flaw in the Grav Login Plugin allows an attacker with valid primary credentials to out-of-band regenerate and read the victim's 2FA secret, successfully bypassing multi-factor protection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS Score**: 7.4 (High)\n- **EPSS Score**: 0.00386\n- **Impact**: Two-Factor Authentication Bypass\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS Core\n- Grav Login Plugin\n- **grav-plugin-login**: < 3.8.11 (Fixed in: `3.8.11`)\n- **grav**: < 2.0.4 (Fixed in: `2.0.4`)\n\n## Mitigation\n\n- Upgrade the Grav Login Plugin to version 3.8.11 or higher.\n- Upgrade Grav CMS Core to version 2.0.4 or higher.\n- Deploy WAF rules to restrict access to the task:login.regenerate2FASecret endpoint.\n\n**Remediation Steps:**\n1. Navigate to the Grav CMS administration panel.\n2. Access the 'Plugins' management tab.\n3. Locate the 'Login' plugin and trigger the update action to retrieve version 3.8.11.\n4. If utilizing command-line administration, execute: bin/gpm update login\n5. Verify the update succeeded and test login flows to ensure session state persists properly.\n\n## References\n\n- [GitHub Security Advisory GHSA-7mgc-c7pq-3rr3](https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3)\n- [Grav Commit 5d1b722298cb](https://github.com/getgrav/grav-plugin-login/commit/5d1b722298cb947d8f434025d121b99152a2c630)\n- [Grav Login Plugin Release 3.8.11](https://github.com/getgrav/grav-plugin-login/releases/tag/3.8.11)\n- [Grav CMS Release 2.0.4](https://github.com/getgrav/grav/releases/tag/2.0.4)\n- [Wiz Vulnerability Database Details](https://www.wiz.io/vulnerability-database/cve/cve-2026-62669)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62669) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/fb22df514827698e37bf556e10bb1199"}, {"timestamp": "2026-09-09T21:13:25.910Z", "date_only": false, "value": "2026-09-09T21:13:25.910", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-62669", "record": "FKIE_CVE-2026-62669", "field": "lastModified"}]}