SA-CONTRIB-2026-201: Critical severity drupal/auth_login_plus vulnerability

Q: Which deployments are affected by this authentication bypass?

Drupal sites using the auth_login_plus module are affected when the optional site-wide setting to enforce TOTP-based 2FA for all users is enabled.

Q: What would an attacker need to take advantage of this issue?

The issue may allow login with only a password despite site-wide 2FA enforcement. An attacker would therefore need a valid user password rather than a second-factor TOTP code.

Published Oct 7, 2026

Updated

This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.

Credit

mouhamed rayen mansouri (w0nd3r)

Affected Software

1 affected componentFixes available

drupal/auth_login_plus<1.0.1

1.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/auth_login_plus to a version that resolves this vulnerability.
Fixed in 1.0.1

Event History

Oct 7, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107261

Frequently Asked Questions

Which deployments are affected by this authentication bypass?

Drupal sites using the auth_login_plus module are affected when the optional site-wide setting to enforce TOTP-based 2FA for all users is enabled.

What would an attacker need to take advantage of this issue?

The issue may allow login with only a password despite site-wide 2FA enforcement. An attacker would therefore need a valid user password rather than a second-factor TOTP code.

SA-CONTRIB-2026-201: Critical severity drupal/auth_login_plus vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are affected by this authentication bypass?

What would an attacker need to take advantage of this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected by this authentication bypass?

What would an attacker need to take advantage of this issue?