Authentication Bypass Vulnerability in Drupal Authenticator Login Plus
CVE-2026-107261

Currently unrated

Key Information:

Vendor: Drupal
Status: Authenticator Login Plus (2fa)
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-107261?

The Authenticator Login Plus (2FA) for Drupal is vulnerable to an authentication bypass, enabling attackers to gain unauthorized access. This security flaw is present in versions ranging from 0.0.0 to 1.0.1. It highlights the importance of timely updates and thorough security practices for safeguarding user accounts.

Affected Version(s)

Authenticator Login Plus (2FA) 0.0.0 < 1.0.1

References

https://www.drupal.org/sa-contrib-2026-201

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 30, 2026
Vulnerability Reserved
Oct 7, 2026

Credit

mouhamed rayen mansouri (w0nd3r)

mugesh.s

Swan Kalata (akalata)

Juraj Nemec (poker10)

CVE-2026-107261 Data

JSON