CVE-2025-31694

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does n...

Original description

The description as published by the source.

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.

The module does not sufficiently ensure that known login routes are not overridden by third-party modules which can allow an access bypass to occur.

This vulnerability is mitigated by the fact that an attacker must obtain a first-factor login credential.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Packagist:https://packages.drupal.org/8 drupal/tfa

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0"}],"database_specific":{"constraint":"<1.10.0"}}]