En resumen
- CVE-2026-107261 es una vulnerabilidad MEDIO (CVSS 4.2) que afecta a drupal/auth_login_plus.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.19%, mayor que el 8.8% de las vulnerabilidades.
- Solución: actualizar a 1.0.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| drupal/auth_login_plus Packagist:https://packages.drupal.org/8 | < 1.0.1
| 1.0.1
|
Description
This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide.
The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.
NVD description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free