View online: https://www.drupal.org/sa-contrib-2026-201 Project: Authenticator Login Plus (2FA) [1] Project machine name: auth_login_plus Date: 2026-October-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper authentication Affected versions: <1.0.1 CVE IDs: CVE-2026-107261 Description: This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on. Solution: *Install the latest version:* * If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1 [3]. After upgrading, users who previously disabled 2FA will be asked to set it up again at their next login. Administrators can also re-enable 2FA for a user from the admin overview so the user keeps their existing authenticator. Reported By: * mouhamed rayen mansouri (w0nd3r) [4] Fixed By: * mugesh.s [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/auth_login_plus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/auth_login_plus/releases/1.0.1 [4] https://www.drupal.org/u/w0nd3r [5] https://www.drupal.org/u/mugeshs [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....