CVE-2026-107261: Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Published Oct 30, 2026

Updated

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

Event History

Oct 30, 2026

CVE Published

via MITRE·03:10 AM

Data Sourced

via MITRE·03:10 AM

DescriptionWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions should be considered affected?

Authenticator Login Plus (2FA) versions from 0.0.0 through 1.0.1 are affected.

Does an attacker need an existing account to exploit this issue?

Yes. The vulnerability is rated with low privileges required, so the attacker must have some level of authenticated access.

Can this be exploited remotely, and how difficult is exploitation?

The attack vector is network-based and does not require user interaction. However, the attack complexity is rated high.

What is the expected impact if exploitation succeeds?

The CVSS vector indicates low impact to confidentiality and integrity, with no availability impact. The scope is unchanged.

CVE-2026-107261: Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Event History

Frequently Asked Questions

Which versions should be considered affected?

Does an attacker need an existing account to exploit this issue?

Can this be exploited remotely, and how difficult is exploitation?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which versions should be considered affected?

Does an attacker need an existing account to exploit this issue?

Can this be exploited remotely, and how difficult is exploitation?

What is the expected impact if exploitation succeeds?