Live › vulnerability › CVE-2026-107254
The Drupal Authenticator Login Plus (2FA) module has an authentication bypass flaw, letting a visitor log in without passing the normal two-factor check. The advisory covers versions from 0.0.0 through 1.0.1.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Authenticator Login Plus (2FA) module in the affected version range are exposed, since the flaw lets a login skip the second factor. Sites that do not use this module are not affected. The sources do not describe further conditions.
No product ranges from the sources yet.
drush pm:list or the module list in the admin UI.0.0.0 to 1.0.1.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-107254")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.