View online: https://www.drupal.org/sa-contrib-2023-030
Project: Two-factor Authentication (TFA) [1] Date: 2023-July-12 Security risk: *Critical* 17∕25 AC:Basic/A:None/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Access bypass
Affected versions: ^1 <= 1.0.0 Description: This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.
The module doesn't sufficiently ensure all core login routes, including the password reset page, require a second factor credential.
This vulnerability is mitigated by the fact that an attacker must obtain a first-factor login credential.
Solution: Install the latest version:
* If you use the Two-factor Authentication (TFA) module for Drupal 8/9 please upgrade to TFA 8.x-1.1 [3]
Ensure all additional external forms of authentication, such as REST, have been disabled.
Reported By: * Conrad Lara [4] * Benji Fisher [5] of the Drupal Security Team
Fixed By: * Lee Rowlands [6] of the Drupal Security Team * João Ventura [7] * Conrad Lara [8] * Benji Fisher [9] of the Drupal Security Team * Mingsong [10] * Jonathan Daggerhart [11] * Vitaliy Bogomazyuk [12] * Giles Birch [13] * N Cantrell [14] * Reinder Venema [15] * Rory Downes [16]
Coordinated By: * Damien McKenna [17] of the Drupal Security Team * Greg Knaddison [18] of the Drupal Security Team
[1] https://www.drupal.org/project/tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tfa/releases/8.x-1.1 [4] https://www.drupal.org/user/1790054 [5] https://www.drupal.org/user/683300 [6] https://www.drupal.org/user/395439 [7] https://www.drupal.org/user/122464 [8] https://www.drupal.org/user/1790054 [9] https://www.drupal.org/user/683300 [10] https://www.drupal.org/user/2986445 [11] https://www.drupal.org/user/167806 [12] https://www.drupal.org/user/3514011 [13] https://www.drupal.org/user/512726 [14] https://www.drupal.org/user/3593195 [15] https://www.drupal.org/user/3669405 [16] https://www.drupal.org/user/2998173 [17] https://www.drupal.org/user/108450 [18] https://www.drupal.org/user/36762