October 2026 - Security-news - lists.drupal.org

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-197 Project: Authenticator Login Plus (2FA) [1] Project machine name: auth_login_plus Date: 2026-October-07 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper authentication Affected versions: <1.0.1 CVE IDs: CVE-2026-107254 Description: This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a victim's account. Solution: Install the latest version: * If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1 [3]. After upgrading, users with 2FA enabled will be asked for their verification code after using a one-time login link. Reported By: * mouhamed rayen mansouri (w0nd3r) [4] Fixed By: * mugesh.s [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/auth_login_plus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/auth_login_plus/releases/1.0.1 [4] https://www.drupal.org/u/w0nd3r [5] https://www.drupal.org/u/mugeshs [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-196 Project: Orphans Media [1] Project machine name: orphans_media Date: 2026-October-07 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-107253 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/orphans_media [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-195 Project: MathJax: LaTeX for Drupal [1] Project machine name: mathjax Date: 2026-October-07 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Affected versions: <4.1.2 CVE IDs: CVE-2026-107252 Description: This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. *Notice:* This release updates CDN URLs where possible and adds a system status warning for unsafe configurations. If you are unable to upgrade immediately, you can modify either the CDN URL or the custom MathJax JavaScript configuration according to the instructions in MathJax Safe-mode [3]. Solution: Install the latest version: * If you use the MathJax module, upgrade to MathJax 4.1.2 [4] * Check the Drupal status report for MathJax module warnings. If "safe mode is not enabled" appears, the MathJax configuration couldn't be automatically updated. Read the information above to manually fix the configuration. Reported By: * cilefen (cilefen) [5] of the Drupal Security Team Fixed By: * bchin [6] * cilefen (cilefen) [7] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/mathjax [2] https://www.drupal.org/security-team/risk-levels [3] https://docs.mathjax.org/en/v2.7/safe-mode.html [4] https://www.drupal.org/project/mathjax/releases/4.1.2 [5] https://www.drupal.org/u/cilefen [6] https://www.drupal.org/u/bchin [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-194 Project: Entity Reference Manager (Merge entities) [1] Project machine name: entity_reference_manager Date: 2026-October-07 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.3 CVE IDs: CVE-2026-107251 Description: Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can access the entity merge functionality and delete arbitrary nodes, taxonomy terms, or media entities. Solution: Install the latest version: * If you use the Entity Reference Manager module, upgrade to Entity Reference Manager 1.0.3 [3] Reported By: * Joshua Sedler (grevil) [4] Fixed By: * Cristiano Demari (cristianodemari) [5] * Joshua Sedler (grevil) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/entity_reference_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_reference_manager/releases/1.0.3 [4] https://www.drupal.org/u/grevil [5] https://www.drupal.org/u/cristianodemari [6] https://www.drupal.org/u/grevil [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-193 Project: ECA Helper [1] Project machine name: eca_helper Date: 2026-October-07 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-107250 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Luke Leber (luke.leber) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/eca_helper [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/lukeleber [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Block AJAX - Critical - PHP object injection - SA-CONTRIB-2026-192
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-192 Project: Block AJAX [1] Project machine name: block_ajax Date: 2026-October-07 Security risk: *Critical* 18 ∕ 25 AC:Basic/A:None/CI:Some/II:All/E:Theoretical/TD:All [2] Vulnerability: PHP object injection Affected versions: <3.0.2 CVE IDs: CVE-2026-107249 Description: The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by the fact that it only affects sites that have Layout Builder enabled (or another block plugin that handles the data this module passes to it in a potentially unsafe way). Please see the release notes for details of potentially breaking changes. Solution: Install the latest version: * If you use the "block_ajax" module, upgrade to block_ajax 3.0.2 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Julian Pustkuchen (anybody) [5] * Joshua Sedler (grevil) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/block_ajax [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_ajax/releases/3.0.2 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/grevil [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/mcdruid [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0