[Security-news] Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-098

Project: Authenticator Login [1]
Date: 2025-August-27
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Affected versions: <2.1.8
CVE IDs: CVE-2025-8093
Description: 
This module allows users to setup two-factor authentication (2FA) using
authenticator apps for enhanced login security.

The module did not protect all possible login paths provided by core modules.

*CVSS risk score (experimental [3]) 6.3 / Medium*

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N [4]

Solution: 
Install the latest version:

  * If you use the Alogin module for Drupal 10^, upgrade to Alogin 2.1.8 [5]

Reported By: 
  * Pierre Rudloff (prudloff) [6]

Fixed By: 
  * Ahmed Raza (ahmed.raza) [7]
  * Pierre Rudloff (prudloff) [8], provisional member of the Drupal Security
    Team

Coordinated By: 
  * Damien McKenna (damienmckenna) [9] of the Drupal Security Team
  * Greg Knaddison (greggles) [10] of the Drupal Security Team
  * Drew Webber (mcdruid) [11] of the Drupal Security Team
  * Juraj Nemec (poker10) [12] of the Drupal Security Team
  * Cathy Theys (yesct) [13] of the Drupal Security Team


[1] https://www.drupal.org/project/alogin
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/securitydrupalorg/issues/3442181
[4]  
https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
[5] https://www.drupal.org/project/alogin/releases/2.1.8
[6] https://www.drupal.org/u/prudloff
[7] https://www.drupal.org/u/ahmedraza
[8] https://www.drupal.org/u/prudloff
[9] https://www.drupal.org/u/damienmckenna
[10] https://www.drupal.org/u/greggles
[11] https://www.drupal.org/u/mcdruid
[12] https://www.drupal.org/u/poker10
[13] https://www.drupal.org/u/yesct