Em resumo
- CVE-2026-107261 é uma vulnerabilidade MÉDIO (CVSS 4.2) que afeta drupal/auth_login_plus.
- Chance de exploração nos próximos 30 dias (EPSS): 0.19%, maior que 8.8% das vulnerabilidades.
- Correção: atualize para 1.0.1 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| drupal/auth_login_plus Packagist:https://packages.drupal.org/8 | < 1.0.1
| 1.0.1
|
Description
This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide.
The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.
NVD description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free