Authentication Bypass Vulnerability in Drupal Enterprise MFA
CVE-2025-47706

4.8MEDIUM

Key Information:

Vendor: Drupal
Status: Enterprise Mfa - Tfa For Drupal
Vendor: CVE Published:; 14 May 2025

What is CVE-2025-47706?

An authentication bypass issue has been identified in the Enterprise MFA - TFA for Drupal, allowing remote services to exploit this vulnerability using stolen credentials. This affects versions prior to 4.7.0 and from 5.0.0 to below 5.2.0. It is crucial for users of this product to update to the latest version to mitigate risks associated with unauthorized access.

Affected Version(s)

Enterprise MFA - TFA for Drupal 0.0.0 < 4.7.0

Enterprise MFA - TFA for Drupal 5.0.0 < 5.2.0

References

https://www.drupal.org/sa-contrib-2025-052

CVSS V3.1

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 14, 2025
Vulnerability Reserved
May 7, 2025

Credit

Conrad Lara (cmlara)

Sudhanshu Dhage (sudhanshu0542)

Greg Knaddison (greggles)

Juraj Nemec (poker10)