{"id":"CVE-2026-107261","kind":"vulnerability","aliases":["CVE-2026-107261"],"related":[],"title":"Drupal Authenticator Login Plus: 2FA can be bypassed through an alternate path","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.","summary":"Authenticator Login Plus (2FA), a Drupal module, has an authentication bypass through an alternate login path. An attacker can get past two-factor login and act as a legitimate user.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authenticator-login-plus","drupal","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Authenticator Login Plus (2FA) Drupal module, for example with `drush pm:list --filter=authenticator_login_plus` or the Extend page in Drupal admin.\n- Confirm whether the module is enabled on the site.","fix":"- Authenticator Login Plus (2FA) versions from `0.0.0` to `1.0.1` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:36+00:00","updated_at":"2026-10-30T04:31:36+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:31:36Z","model":"claude-haiku-5-5","output":{"fix":"- Authenticator Login Plus (2FA) versions from `0.0.0` to `1.0.1` are affected; the sources do not name a fixed version.","reach":"internet","title":"Drupal Authenticator Login Plus: 2FA can be bypassed through an alternate path","impact":"high","summary":"Authenticator Login Plus (2FA), a Drupal module, has an authentication bypass through an alternate login path. An attacker can get past two-factor login and act as a legitimate user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","authenticator-login-plus","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker logs in as a user without the second factor","analyst_note":"Find the advisory from the Drupal security team and the NVD page for the fixed version, the exact bypass conditions, and whether a patch exists.","how_to_check":"- Check the installed version of the Authenticator Login Plus (2FA) Drupal module, for example with `drush pm:list --filter=authenticator_login_plus` or the Extend page in Drupal admin.\n- Confirm whether the module is enabled on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Authenticator Login Plus (2FA) module within the affected version range are exposed, since the bypass lets a login skip the second factor. Sites without this module are not affected. The sources do not describe whether the flaw needs a specific configuration.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4123,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107261':15A,18A '-2026':14A,17A '0.0.0':86C '1.0.1':88C '2fa':5A,31B,73C,83C 'act':54B 'affect':79C 'allow':74C 'altern':11A,41B,63C 'attack':45B 'authent':2A,20B,28B,37B,59C,70C,75C,80C 'authenticator-login-plus':19B 'bypass':8A,38B,60C,76C 'channel':66C 'cve':13A,16A 'drupal':1A,23B,33B,69C 'factor':51B 'get':47B 'host':27B 'issu':78C 'legitim':57B 'login':3A,21B,29B,42B,52B,71C,81C 'modul':34B 'packag':24B 'past':48B 'path':12A,43B,64C 'plus':4A,22B,30B,72C,82C 'self':26B 'self-host':25B 'two':50B 'two-factor':49B 'use':61C 'user':58B 'version':84C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Authenticator Login Plus (2FA) module within the affected version range are exposed, since the bypass lets a login skip the second factor. Sites without this module are not affected. The sources do not describe whether the flaw needs a specific configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107261","severity":null,"published_at":"2026-10-30T04:17:55+00:00","modified_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}