Authenticator Login Plus CVE-2026-107261

Exploitation requires that the target Drupal site has the Authenticator Login Plus (2FA) contrib module installed and enabled at a vulnerable version (0.0.0 through 1.0.1), and that two-factor authentication is actually being relied upon as a control. Per the CVSS vector, the attacker needs low-level privileges (PR:L) - consistent with already holding valid first-factor credentials for an account - and acts over the network with no user interaction. Limiting factors: high attack complexity (AC:H) indicates conditions outside the attacker's direct control must be met, the module must be present (it is optional contrib, not core), and the attacker must first obtain a legitimate credential set to have anything to bypass. The specific feature, configuration setting, or alternate channel that enables the bypass is not described in the available sources.

This is a genuine but low-to-moderate priority issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) yields a base score of 4.2 (Medium): remotely reachable but with high attack complexity, requiring low-level privileges (PR:L, i.e. the attacker must already hold some authenticated foothold such as valid first-factor credentials), no user interaction, and only Low confidentiality and integrity impact with no availability impact. Multiple real-world signals agree on contained risk: EPSS is just 0.19% (9th percentile), indicating a low modeled probability of exploitation in the near term; the CVE is NOT listed in CISA KEV (no confirmed active exploitation); and no public exploit code or PoC reference is present in the supplied data. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a patch-this-cycle posture. The signals are mutually consistent - low EPSS, no KEV, Medium CVSS, and a 'this_month' decision all point the same direction - so there is no conflicting data to flag. One caveat: AC:H and the 'alternate path or channel' authentication-bypass class (CWE-288) mean the exact trigger is not described in the available sources, so the true difficulty of achieving the bypass cannot be independently verified from this input.

An attacker who already possesses valid first-factor credentials for a Drupal site running the Authenticator Login Plus (2FA) module (version ≤1.0.1) leverages an alternate authentication path or channel to complete login without satisfying the second factor, defeating the 2FA protection. No public exploit code or PoC reference is present in the supplied data, and the high attack complexity (AC:H) suggests the bypass is not trivially reproducible.