View online: https://www.drupal.org/sa-contrib-2025-098

Project: Authenticator Login [1] Date: 2025-August-27 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass

Affected versions: <2.1.8 CVE IDs: CVE-2025-8093 Description:  This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security.

The module did not protect all possible login paths provided by core modules.

*CVSS risk score (experimental [3]) 6.3 / Medium*

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N [4]

Solution:  Install the latest version:

* If you use the Alogin module for Drupal 10^, upgrade to Alogin 2.1.8 [5]

Reported By:  * Pierre Rudloff (prudloff) [6]

Fixed By:  * Ahmed Raza (ahmed.raza) [7] * Pierre Rudloff (prudloff) [8], provisional member of the Drupal Security Team

Coordinated By:  * Damien McKenna (damienmckenna) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Drew Webber (mcdruid) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Cathy Theys (yesct) [13] of the Drupal Security Team

[1] https://www.drupal.org/project/alogin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/securitydrupalorg/issues/3442181 [4] https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/... [5] https://www.drupal.org/project/alogin/releases/2.1.8 [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/ahmedraza [8] https://www.drupal.org/u/prudloff [9] https://www.drupal.org/u/damienmckenna [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/mcdruid [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/yesct