[Security-news] Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-023

Project: Two-factor Authentication (TFA) [1]
Date: 2025-March-05
Security risk: *Moderately critical* 13 ∕ 25
AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass

Affected versions: <1.10.0
Description: 
This module enables you to allow and/or require users to use a second
authentication method in addition to password authentication.

The module does not sufficiently ensure that known login routes are not
overridden by third-party modules which can allow an access bypass to occur.

This vulnerability is mitigated by the fact that an attacker must obtain a
first-factor login credential.

Solution: 
Install the latest version and run database updates:

  1) If you use the Two-factor Authentication (TFA) module for Drupal 8.x,
     upgrade to Two-factor Authentication (TFA)  8.x-1.10 [3]
  2) Run the database updates. See help documentation [4] on how to run
     database updates.

TFA 8.x-1.10 will provide a status report error if it detects a known route
is being bypassed.

Caution: TFA 8.x-1.10 will attempt to restore these routes to expected norms.
   This may disable routes added by other modules.

Reported By: 
  * Conrad Lara (cmlara) [5]
  * Elaman Imashov (elaman) [6]

Fixed By: 
  * Conrad Lara (cmlara) [7]

Coordinated By: 
  * Greg Knaddison (greggles) [8] of the Drupal Security Team


[1] https://www.drupal.org/project/tfa
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/tfa/releases/8.x-1.10
[4]  
https://www.drupal.org/docs/updating-drupal/updating-drupal-core-via-composer#s-run-database-updates
[5] https://www.drupal.org/u/cmlara
[6] https://www.drupal.org/u/elaman
[7] https://www.drupal.org/u/cmlara
[8] https://www.drupal.org/u/greggles