Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
Authenticator Login Plus (2FA) versions before 1.0.1 on Drupal 10 or 11 do not require the second factor when a user logs in with Drupal core's one-time login link. Fixed in 1.0.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 1.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The Authenticator Login Plus (2FA) module for Drupal, a two-factor authentication add-on for Drupal websites, is affected by this flaw. An attacker could bypass the login protections and gain access to accounts without completing the required authentication steps.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Drupal Authenticator Login Plus (2FA)
From 0.0.0 · fixed in 1.0.1
References 1
drupal.org
Questions about CVE-2026-107254
What does this mean?
When a user with 2FA enabled logs in through Drupal core's one-time login link, the module does not enforce the second factor (the TOTP verification code). Anyone holding a valid one-time link for that account can therefore log in without passing two-factor authentication.Source: drupal.org
Am I affected, and how do I check?
The module is affected on Drupal 10 or 11 when the installed version is before 1.0.1. Check the installed version of Authenticator Login Plus (2FA) and your Drupal core version on the site's extensions or status page.Source: drupal.org
What should I do about it?
Upgrade Authenticator Login Plus (2FA) to 1.0.1, which is the fixed version named in the advisory.Source: drupal.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data