Authentication Bypass in Drupal Authenticator Login Plus (2FA)
CVE-2026-107254

Currently unrated

Key Information:

Vendor: Drupal
Status: Authenticator Login Plus (2fa)
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-107254?

A security flaw in Drupal's Authenticator Login Plus (2FA) enables attackers to bypass authentication protocols through an alternate path or channel. This vulnerability compromises user security by allowing unauthorized access without proper credentials. The issue affects versions from 0.0.0 to 1.0.1, necessitating immediate action to upgrade and safeguard sensitive information.

Affected Version(s)

Authenticator Login Plus (2FA) 0.0.0 < 1.0.1

References

https://www.drupal.org/sa-contrib-2026-197

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 30, 2026
Vulnerability Reserved
Oct 7, 2026

Credit

mouhamed rayen mansouri (w0nd3r)

mugesh.s

Swan Kalata (akalata)

Juraj Nemec (poker10)

CVE-2026-107254 Data

JSON