CVE-2026-107254

This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second factor when a user logs in with Dru...

Original description

The description as published by the source.

This module provides TOTP-based two-factor authentication (2FA) for Drupal.

The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link.

This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a victim's account.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Packagist:https://packages.drupal.org/8 drupal/auth_login_plus

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}],"database_specific":{"constraint":"<1.0.1"}}]