CVE-2026-107268: Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Published Oct 30, 2026

Updated

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Two Factor Authentication - TFA / Passwordless Login to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-207

Event History

Oct 30, 2026

CVE Published

via MITRE·03:10 AM

Data Sourced

via MITRE·03:10 AM

DescriptionWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions require remediation?

Affected versions are 0.0.0 through 5.4.1 and 5.5.0 through 5.5.2. Version 5.4.2 and versions later than 5.5.2 are not identified as affected in the provided data.

What level of access does an attacker need?

The vector indicates network-reachable exploitation with low attack complexity and requires low privileges. No user interaction is required.

What is the likely impact if exploited?

The issue is classified as information disclosure with low confidentiality impact. The supplied vector indicates no integrity or availability impact.

CVE-2026-107268: Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Remediation

Event History

Frequently Asked Questions

Which versions require remediation?

What level of access does an attacker need?

What is the likely impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Which versions require remediation?

What level of access does an attacker need?

What is the likely impact if exploited?