Nixpkgs security tracker

Untriaged

Permalink CVE-2026-62669

7.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 2 weeks, 2 days ago Activity log

Created suggestion 2 weeks, 2 days ago

Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.

References

https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c7pq-3rr3 x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-login/commit/5d1b722298cb947d8f434025d121b99152a2c630 x_refsource_MISC
https://github.com/getgrav/grav-plugin-login/releases/tag/3.8.11 x_refsource_MISC

Affected products

grav

==< 2.0.4

grav-plugin-login

==< 3.8.11

Matching in nixpkgs

pkgs.grav

Fast, simple, and flexible, file-based web platform

nixos-unstable 1.7.53
- nixpkgs-unstable 1.7.53
- nixos-unstable-small 1.7.53.2
nixos-26.05 1.7.53
- nixos-26.05-small 1.7.53.2
- nixpkgs-26.05-darwin 1.7.53

pkgs.gravit

Beautiful OpenGL-based gravity simulator

nixos-unstable 0.5.1
- nixpkgs-unstable 0.5.1
- nixos-unstable-small 0.5.1
nixos-26.05 0.5.1
- nixos-26.05-small 0.5.1
- nixpkgs-26.05-darwin 0.5.1

pkgs.antigravity

Agentic development platform, evolving the IDE into the agent-first era

nixos-unstable 1.23.2
- nixpkgs-unstable 1.23.2
- nixos-unstable-small 2.5.5
nixos-26.05 1.23.2
- nixos-26.05-small 1.23.2
- nixpkgs-26.05-darwin 1.23.2

pkgs.antigravity-cli

Google's Go-based terminal user interface (TUI) agent client

nixos-unstable 1.0.12
- nixpkgs-unstable 1.0.12
- nixos-unstable-small 1.1.13

pkgs.antigravity-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications

nixos-unstable 1.23.2
- nixpkgs-unstable 1.23.2
- nixos-unstable-small 2.5.5
nixos-26.05 1.23.2
- nixos-26.05-small 1.23.2
- nixpkgs-26.05-darwin 1.23.2

pkgs.antigravity-ide

Agentic development platform, evolving the IDE into the agent-first era

nixos-unstable -
- nixos-unstable-small 2.5.5

pkgs.antigravity-ide-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications

nixos-unstable -
- nixos-unstable-small 2.5.5

pkgs.stardust-xr-gravity

Utility to launch apps and stardust clients at an offset

nixos-unstable 0-unstable-2024-12-29
- nixpkgs-unstable 0-unstable-2024-12-29
- nixos-unstable-small 0.51.1
nixos-26.05 0-unstable-2024-12-29
- nixos-26.05-small 0.51.1
- nixpkgs-26.05-darwin 0-unstable-2024-12-29

pkgs.kdePackages.libgravatar

Library that provides Gravatar support

nixos-unstable 26.04.2
- nixpkgs-unstable 26.04.2
- nixos-unstable-small 26.04.3
nixos-26.05 26.04.2
- nixos-26.05-small 26.04.3
- nixpkgs-26.05-darwin 26.04.2