{"id":"CVE-2026-107254","kind":"vulnerability","aliases":["CVE-2026-107254"],"related":[],"title":"Drupal Authenticator Login Plus: authentication bypass via alternate path","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.","summary":"The Drupal Authenticator Login Plus (2FA) module has an authentication bypass flaw, letting a visitor log in without passing the normal two-factor check. The advisory covers versions from 0.0.0 through 1.0.1.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Authenticator Login Plus (2FA) module on the Drupal site, for example with `drush pm:list` or the module list in the admin UI.\n- Confirm whether the installed version falls within `0.0.0` to `1.0.1`.","fix":null,"status":"open","published_at":"2026-10-30T04:17:48+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:42+00:00","updated_at":"2026-10-30T04:31:42+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Authenticator Login Plus: authentication bypass via alternate path","impact":"high","summary":"The Drupal Authenticator Login Plus (2FA) module has an authentication bypass flaw, letting a visitor log in without passing the normal two-factor check. The advisory covers versions from 0.0.0 through 1.0.1.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker logs in as another user without the second factor","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version and exact preconditions; the sources given here state neither.","how_to_check":"- Check the installed version of the Authenticator Login Plus (2FA) module on the Drupal site, for example with `drush pm:list` or the module list in the admin UI.\n- Confirm whether the installed version falls within `0.0.0` to `1.0.1`.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Authenticator Login Plus (2FA) module in the affected version range are exposed, since the flaw lets a login skip the second factor. Sites that do not use this module are not affected. The sources do not describe further conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4123,"output_tokens":530,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107254':12A,15A '-2026':11A,14A '0.0.0':52B,82C '1.0.1':54B,84C '2fa':27B,69C,79C 'advisori':48B 'affect':75C 'allow':70C 'altern':8A,59C 'authent':2A,5A,24B,31B,55C,66C,71C,76C 'bypass':6A,32B,56C,72C 'channel':62C 'check':46B 'cover':49B 'cve':10A,13A 'drupal':1A,16B,23B,65C 'factor':45B 'flaw':33B 'host':21B 'issu':74C 'let':34B 'log':37B 'login':3A,25B,67C,77C 'modul':28B 'normal':42B 'packag':17B 'pass':40B 'path':9A,60C 'php':18B 'plus':4A,26B,68C,78C 'self':20B 'self-host':19B 'two':44B 'two-factor':43B 'use':57C 'version':50B,80C 'via':7A 'visitor':36B 'vulner':63C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Authenticator Login Plus (2FA) module in the affected version range are exposed, since the flaw lets a login skip the second factor. Sites that do not use this module are not affected. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107254","severity":null,"published_at":"2026-10-30T04:17:48+00:00","modified_at":"2026-10-30T04:17:48+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}