Threats tagged 'drupal-contrib-2026-320'

The Auth login plus module for Drupal enables two-factor authentication using time-based one-time passwords. However, it does not fully enforce the second factor for authentication providers that authenticate each request independently. An attacker who knows a user's password and if certain authentication providers (e.g., HTTP Basic Authentication) and alternate methods (e.g., JSON:API or REST) are enabled can bypass the second factor and access the account's permissions. This vulnerability is fixed in version 1.0.3.