SB2026111233 - Multiple vulnerabilities in Authenticator Login Plus (2FA) module for Drupal

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2026-126729)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the affected module does not sufficiently enforce the second factor for authentication providers that authenticate every request on their own. A remote attacker can bypass authentication process without providing the second factor authentication.

2) Improper Authentication (CVE-ID: CVE-2026-126731)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote user can bypass authentication process and gain unauthorized access to the application.

3) Improper Authentication (CVE-ID: CVE-2026-126730)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the affected module does not enforce the second authentication factor correctly. A remote attacker with only the first factor for an account with 2FA can trigger actions that should only follow a fully authenticated login.

Remediation

Install update from vendor's website.

References

• https://www.drupal.org/sa-contrib-2026-320
• https://www.drupal.org/sa-contrib-2026-322
• https://www.drupal.org/sa-contrib-2026-321