CVE-2025-31681: Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing. This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
Other sources
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31681?
CVE-2025-31681 is considered a moderate severity vulnerability due to its missing authorization allowing forceful browsing.
How do I fix CVE-2025-31681?
To fix CVE-2025-31681, update the Authenticator Login module to version 2.0.6 or later.
What software is affected by CVE-2025-31681?
CVE-2025-31681 affects the Drupal Authenticator Login module versions from 0.0.0 up to, but not including, 2.0.6.
What type of vulnerability is CVE-2025-31681?
CVE-2025-31681 is a missing authorization vulnerability that allows unauthorized forceful browsing.
Is there a patch available for CVE-2025-31681?
Yes, a patch is available in the form of an update to version 2.0.6 or later of the Authenticator Login module.