Threats tagged 'drupal-contrib-2026-322'

The Auth login plus module for Drupal allows enforcing a second authentication factor using time-based one-time passwords. A vulnerability exists where an attacker, under certain conditions, can bypass the password check or access the two-factor setup page of another user's account. This may enable account takeover of 2FA-enabled accounts without knowing the victim's password or second factor. Exploitation requires the attacker to have their own account, control the victim's email or know their password, and succeed in a timing-dependent race. The issue is fixed in version 1.0.3.