CVE-2025-8093

HIGH 8.8CVE-2025-8093 · DRUPAL-CONTRIB-2025-098 · Published 10/10/2025 · updated 08/10/2026

In short

CVE-2025-8093 is a HIGH (CVSS 8.8) vulnerability affecting drupal/alogin, authenticator login (authenticator login project).
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 29.2% of all vulnerabilities.
Fix: update to 2.1.8 or later.

Package	Affected versions	Patched versions
drupal/alogin Packagist:https://packages.drupal.org/8	`< 2.1.8`	`2.1.8`
authenticator login authenticator_login_project	`< 2.1.8`	`2.1.8`

Description

This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security.

The module did not protect all possible login paths provided by core modules.

CVSS risk score (experimental) 6.3 / Medium

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

NVD description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.

References

drupal.org/sa-contrib-2025-098 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free