SA-CONTRIB-2026-207: Critical severity drupal/miniorange_2fa vulnerability

Q: Which sites are exposed to this issue?

Sites are exposed only if Headless 2FA has been enabled. Enabling it requires a user with the restricted miniorange 2fa headless permission.

Q: Does an attacker need to authenticate to retrieve the key?

No. The headless login endpoint can disclose the stored miniOrange customer API key to unauthenticated users.

Published Oct 7, 2026

Updated

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated users. The vulnerability is mitigated by the fact that Headless 2FA must be turned on by a user with a miniorange 2fa headless permission, which is a restricted permission.

Credit

Nam Nguyen Le Thanh (yuwkaa)

Affected Software

1 affected componentFixes available

drupal/miniorange_2fa<5.5.2, <5.4.1

5.5.25.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/miniorange_2fa to a version that resolves this vulnerability.
Fixed in 5.5.2Fixed in 5.4.1

Event History

Oct 7, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107268

Frequently Asked Questions

Which sites are exposed to this issue?