CVE-2026-126730: Composer/drupal/auth_login_plus vulnerability
This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.
The module does not enforce the second authentication factor correctly. As a result, an attacker who has only the first factor for an account with 2FA (for example, a valid one-time login link) could trigger actions that should only follow a fully authenticated login. These include updating the account's last login time, (which also invalidates other one-time login links) and running other modules' login hooks.
The vulnerability is mitigated by the fact that the attacker must already have the account's first factor (a valid one-time login link, or a login through another module), and the impact depends on which other modules react to user logins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/auth_login_plusto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Accounts protected by this module's second authentication factor are exposed if an attacker already possesses that account's first factor, such as a valid one-time login link or access through another login module. The practical impact also depends on which installed modules perform actions in response to user login events.
What does an attacker need to exploit it?
The attacker must have the target account's first authentication factor. The data specifically identifies a valid one-time login link or a login through another module as possible ways to satisfy that requirement; the attacker does not need to complete the time-based one-time-password factor.
What can happen if exploitation succeeds?
The attacker can trigger actions intended to occur only after a fully authenticated login. This includes updating the account's last-login time, which invalidates other one-time login links, and causing other modules' login hooks to run.