SA-CONTRIB-2026-321: Critical severity composer/drupal/auth_login_plus vulnerability
This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in. The module does not enforce the second authentication factor correctly. As a result, an attacker who has only the first factor for an account with 2FA (for example, a valid one-time login link) could trigger actions that should only follow a fully authenticated login. These include updating the account's last login time, (which also invalidates other one-time login links) and running other modules' login hooks. The vulnerability is mitigated by the fact that the attacker must already have the account's first factor (a valid one-time login link, or a login through another module), and the impact depends on which other modules react to user logins.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/auth_login_plusto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
What must an attacker already possess to exploit this issue?
The attacker must already have the account's first factor, such as a valid one-time login link or a login obtained through another module. The issue does not provide a way to authenticate without that first factor.
What effects should administrators assess in their own deployment?
An attacker may update the affected account's last-login time, which invalidates other one-time login links, and may cause other modules' login hooks to run. The practical impact depends on which installed modules perform actions in response to user logins.