DRUPAL-CONTRIB-2026-321: Composer/drupal/auth_login_plus vulnerability
This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.
The module does not enforce the second authentication factor correctly. As a result, an attacker who has only the first factor for an account with 2FA (for example, a valid one-time login link) could trigger actions that should only follow a fully authenticated login. These include updating the account's last login time, (which also invalidates other one-time login links) and running other modules' login hooks.
The vulnerability is mitigated by the fact that the attacker must already have the account's first factor (a valid one-time login link, or a login through another module), and the impact depends on which other modules react to user logins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/auth_login_plusto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
What must an attacker have to exploit this issue?
The attacker must already possess the affected account's first authentication factor. Examples given include a valid one-time login link or a login obtained through another module.
What effects can occur without successful completion of the second factor?
An attacker may trigger actions intended to occur only after fully authenticated login, including updating the account's last-login time. Updating that time can invalidate other one-time login links, and other modules' login hooks may also run.
How can I assess the likely impact in my deployment?
Review which installed modules react to user-login events or hooks, since the impact depends on their behavior. Also identify accounts using this module's 2FA flow and whether valid one-time login links or alternate module-based login paths could be obtained for them.