CVE-2026-107254: Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
Published Oct 30, 2026
·Updated
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:10 AM
Data Sourced
via MITRE·03:10 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments should be considered affected?
Drupal sites using Authenticator Login Plus (2FA) versions from 0.0.0 through 1.0.1 are affected.
2
Does exploitation require an authenticated account or user interaction?
No. The CVSS vector indicates that exploitation does not require prior privileges or user interaction, although it has high attack complexity and requires network access.