Most recent entries from all

DRUPAL-CONTRIB-2025-096

Affected: Packagist:https://packages.drupal.org/8: drupal/alogin

This module enables users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. The module alters the standard Drupal login form to use AJAX callbacks for handling authentication flow.

The module doesn't sufficiently validate authentication under specific conditions, allowing an attacker to log in as any account where they know the username.

This vulnerability is mitigated by the fact that an attacker must make a series of requests to trigger the necessary conditions that allow authentication byass. The series of requests could alert a site owner that they are being attacked; however, the number of requests necessary to trigger the conditions is usually quite small (the number depends on site configuration, by default it is 5).

EUVD-2026-272107

fkie_cve-2025-8995

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.

GHSA-x4hh-vfx4-455p

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.

WID-SEC-W-2025-1825 — Drupal (Authenticator Login und Layout Builder Advanced Permissions): Mehrere Schwachstellen ermöglichen Umgehen von Si…

Ein Angreifer kann mehrere Schwachstellen in Drupal Authenticator Login und Drupal Layout Builder Advanced Permissions ausnutzen, um Sicherheitsvorkehrungen zu umgehen.