CVE-2026-107261

MediumCVSS 4.2

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

An authentication bypass using an alternate path or channel in the Drupal Authenticator Login Plus (2FA) module allows bypassing the login mechanism. This issue affects versions from 0.0.0 to 1.0.1.

Risk Assessment

An attacker could gain access to protected resources without proper authentication, undermining the effectiveness of the deployed two-factor authentication.

Recommendation

Update the Authenticator Login Plus (2FA) module to a version later than 1.0.1.

Other vulnerabilities in Drupal Authenticator Login Plus (2FA)

CVE-2026-107254Medium
The Authenticator Login Plus (2FA) module for Drupal allows authentication bypass using an alternate path or channel. This affects versions from 0.0.0 to 1.0.1.

Original NVD description (English source)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS