Authenticator Login CVE-2025-8093

Requires that the target Drupal site has the Authenticator Login module installed and enabled at a version below 2.1.8 to provide second-factor authentication. Exploitation also requires the attacker to possess valid primary (first-factor) credentials for a target account, since PR:L indicates low-level privileges are needed; the flaw lets that actor bypass the module's second factor via an alternate path/channel (CWE-288). Limiting factors: sites not using this specific contrib module are unaffected, no user interaction is required (UI:N), and impact is bounded to accounts whose first-factor credentials the attacker can supply.

Signals are moderately consistent but point to a mid-tier operational priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring some existing privileges (PR:L), with high confidentiality, integrity, and availability impact (C:H/I:H/A:H) and unchanged scope - consistent with an authenticated attacker bypassing the module's second authentication factor to fully take over a Drupal account. Counterbalancing this, EPSS is low at 0.35% (26th percentile), there is NO CISA KEV listing and NO public exploit identified at time of analysis, so there is no evidence of active or imminent mass exploitation. The low EPSS alongside a vendor patch and no POC suggests this is a 'patch in normal cycle' item, not a drop-everything issue - though note the CVSS 8.8 HIGH score reflects worst-case account-takeover impact, which materializes only where the Authenticator Login module is actually deployed and where the attacker already holds valid first-factor credentials. A limitation: the description is terse ('allows Authentication Bypass') and does not specify the exact bypass path, so the precise PR requirement is inferred from the published CVSS vector rather than confirmed technical detail.

An attacker who already possesses or has phished a user's primary Drupal credentials (username/password) leverages an alternate authentication path in the Authenticator Login module to skip the required second factor, completing login without the TOTP/one-time code and gaining full account access. No public exploit code was identified at time of analysis, and the low complexity (AC:L) means no special timing or race conditions are needed once valid first-factor credentials are held.