Live › vulnerability › CVE-2026-107268
The Drupal Two Factor Authentication (TFA) and Passwordless Login module sends sensitive information in responses, and it allows forceful browsing. The sources do not say what the data is or what an attacker can do with it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Two Factor Authentication - TFA / Passwordless Login module in the affected version ranges are exposed. The sources do not describe the exact data path or configuration needed, so it is unknown whether every site with the module is at risk. Sites without the module are not affected.
No product ranges from the sources yet.
drush pm:list or the module list in the admin UI).0.0.0 to 5.4.1, or 5.5.0 to 5.5.2.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-107268")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.