View online: https://www.drupal.org/sa-contrib-2026-197 Project: Authenticator Login Plus (2FA) [1] Project machine name: auth_login_plus Date: 2026-October-07 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper authentication Affected versions: <1.0.1 CVE IDs: CVE-2026-107254 Description: This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a victim's account. Solution: Install the latest version: * If you use the Authenticator Login Plus (2FA) module for Drupal 10 or 11, upgrade to Authenticator Login Plus (2FA) 1.0.1 [3]. After upgrading, users with 2FA enabled will be asked for their verification code after using a one-time login link. Reported By: * mouhamed rayen mansouri (w0nd3r) [4] Fixed By: * mugesh.s [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/auth_login_plus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/auth_login_plus/releases/1.0.1 [4] https://www.drupal.org/u/w0nd3r [5] https://www.drupal.org/u/mugeshs [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....