Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207
Affects Two Factor Authentication - TFA / Passwordless Login below 5.4.1 and 5.5.0 before 5.5.2, when headless 2FA is turned on. Fixed in 5.5.2.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 5.4.1, 5.5.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The Two Factor Authentication (TFA) / Passwordless Login module for Drupal is affected. A flaw in this module can cause sensitive information to be included in data sent to users, and it can be reached by directly requesting pages that should not be accessed, which may allow unauthorized parties to view private information.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Drupal Two Factor Authentication - TFA / Passwordless Login
From 0.0.0 · fixed in 5.4.1; From 5.5.0 · fixed in 5.5.2
References 2
drupal.org
GitHub · yuwkaaa/CVE-2026-107268
Questions about CVE-2026-107268
What does this mean?
The module's headless login endpoint response can include the site's stored miniOrange customer API key, which unauthenticated users can then read.Source: drupal.org
Am I affected, and how do I check?
Module versions below 5.4.1, and 5.5.0 up to but not including 5.5.2, are affected, but only when headless 2FA is turned on by a user with the miniorange 2fa headless permission. Check the installed version on the Drupal module list or with composer show drupal/tfa.Source: drupal.org
What should I do about it?
If you are on the 5.5.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.5.2. Versions below 5.4.1 are also in the affected range.Source: drupal.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data