Threats tagged 'drupal-contrib-2026-321'

The Auth login plus module for Drupal allows requiring a second authentication factor (time-based one-time password) on user login. However, it fails to enforce the second factor correctly, allowing an attacker with only the first factor (such as a valid one-time login link) to trigger actions normally restricted to fully authenticated logins. These actions include updating the account's last login time and triggering other modules' login hooks. The impact depends on other modules reacting to login events. A fix is available in version 1.0.3.