Kurz gesagt
- CVE-2026-107261 ist eine Schwachstelle (MITTEL (CVSS 4.2)) in drupal/auth_login_plus.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.19%, höher als bei 8.8% aller Schwachstellen.
- Abhilfe: auf 1.0.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| drupal/auth_login_plus Packagist:https://packages.drupal.org/8 | < 1.0.1
| 1.0.1
|
Description
This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide.
The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.
NVD description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free