CVE-2026-107254

MediumCVSS 4.8

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

The Authenticator Login Plus (2FA) module for Drupal allows authentication bypass using an alternate path or channel. This affects versions from 0.0.0 to 1.0.1.

Risk Assessment

An attacker can bypass the two-factor mechanism and access an account without the second factor. This weakens protection of administrative accounts.

Recommendation

Update the Authenticator Login Plus (2FA) module to a version later than 1.0.1. Review access logs for suspicious authentication bypasses.

Other vulnerabilities in Drupal Authenticator Login Plus (2FA)

CVE-2026-107261Medium
An authentication bypass using an alternate path or channel in the Drupal Authenticator Login Plus (2FA) module allows bypassing the login mechanism. This issue affects versions from 0.0.0 to 1.0.1.

Original NVD description (English source)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS