Authenticator Login Plus CVE-2026-107254

Exploitation requires a Drupal site with the Authenticator Login Plus (2FA) contributed module installed and enabled at a vulnerable version (0.0.0 through 1.0.1); sites not running this specific module are unaffected. The flaw is an authentication bypass via an alternate path or channel (CWE-288), so the second-factor enforcement is the targeted control - meaning the module must actually be relied upon for 2FA for the bypass to matter. Limiting factors: CVSS rates attack complexity HIGH (AC:H), indicating a condition outside the attacker's control must hold for success, which reduces reliability; impact is partial (C:L/I:L, A:N). The exact configuration or channel that enables the bypass is not described in the available sources and should be confirmed against the Drupal advisory.

This is a moderate-severity issue (CVSS 4.8) that does not rise to an urgent, widely-weaponized threat, though the vendor priority label (this_month) indicates it should not be ignored. The CVSS vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated-trigger flaw with HIGH attack complexity, meaning some condition outside the attacker's direct control must be met for success - the available sources do not describe what that condition is. EPSS is low at 0.19% (9th percentile), consistent with no observed exploitation activity. There is no CISA KEV listing and no public exploit identified in the input, so this is not confirmed actively exploited. The confidentiality and integrity impacts are both Low and availability impact is None, reflecting a partial authentication-bypass rather than full account or system takeover. Net assessment: a real but non-emergency defensive item - the combination of low EPSS, no KEV, no identified PoC, high attack complexity, and limited impact places this well below critical-priority flaws, while the unauthenticated network vector and the security-sensitive nature of a 2FA bypass justify patching within the vendor's suggested this-month window. Note a signal tension worth verifying: the flaw is in a two-factor authentication module yet NVD rates it PR:N (no privileges), which is plausible for a pre-authentication alternate-channel bypass but should be confirmed against the Drupal advisory.

An attacker targeting a Drupal site running the Authenticator Login Plus (2FA) module (version 1.0.1 or earlier) leverages an alternate authentication path or channel to bypass the second-factor check, reducing login security to single-factor. The HIGH attack complexity (AC:H) implies success depends on a condition not fully under the attacker's control, so exploitation is not reliably repeatable. No public exploit code was identified in the available data, so this scenario is inferred from the CWE-288 classification and CVSS vector rather than a demonstrated PoC.