Sensitive Information Exposure in Drupal Two Factor Authentication by Drupal

CVE-2026-107268

What is CVE-2026-107268?

A vulnerability has been identified in the Two Factor Authentication (TFA) / Passwordless Login module for Drupal, enabling the potential exposure of sensitive information due to improper handling of user data. This issue allows unauthorized users to exploit weaknesses in the system, leading to forceful browsing and access to secured content. It affects specific versions of the module, necessitating prompt attention from users to secure their installations.

References