DRUPAL-CONTRIB-2026-320: Composer/drupal/auth_login_plus vulnerability
This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.
The module doesn't sufficiently enforce the second factor for authentication providers that authenticate every request on their own. An attacker who knows the password of an account with two-factor authentication enabled can use that account's permissions through routes that accept such a provider, without providing the second factor.
This vulnerability is mitigated by the fact that the attacker must know the account's password, a per-request authentication provider (such as the the HTTP Basic Authentication module) must be enabled, and an alternate authentication method (such as JSON:API or REST) must be enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/auth_login_plusto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when the module is used for two-factor authentication, a per-request authentication provider such as HTTP Basic Authentication is enabled, and an alternate authentication method such as JSON:API or REST is enabled. Accounts must also have two-factor authentication enabled.
What does an attacker need to exploit it?
An attacker must know the password for an account that has two-factor authentication enabled. They must then access routes that accept an enabled per-request authentication provider, allowing use of that account's permissions without supplying the second factor.
Is the default login flow alone sufficient for exploitation?
No. Exploitation additionally requires an enabled per-request authentication provider and an enabled alternate authentication method, such as JSON:API or REST.
What can be done if the module cannot be updated immediately?
Disable per-request authentication providers such as HTTP Basic Authentication, or disable alternate authentication methods such as JSON:API or REST where they are not required. Limiting these conditions removes prerequisites described for exploitation.