TFA Passwordless Login CVE-2026-107268

Exploitation requires an authenticated session with at least low-level privileges (PR:L) on a Drupal site running Two Factor Authentication - TFA / Passwordless Login at a vulnerable version (any release below 5.4.1, or 5.5.0 through 5.5.1). The flaw is reachable over the network with low complexity and no user interaction, via forceful browsing (direct access to a resource whose authorization is not enforced). The exact feature, endpoint, or configuration that must be present to trigger the disclosure is not described in the available sources. Limiting factors: the attacker must already hold valid credentials on the target site, impact is confined to confidentiality (no integrity or availability effect), and only sites that have installed this specific contrib module are affected.

This is a genuinely low-priority issue despite being a vulnerability in a security-relevant module. The CVSS 3.1 base score is 4.3 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N consistently describes a network-reachable, low-complexity flaw that requires existing low-level privileges (PR:L) and yields only limited confidentiality impact with no integrity or availability effect - a pure information-disclosure weakness (CWE-201, Insertion of Sensitive Information Into Sent Data, via Forceful Browsing). All signals agree that this is not an emergency: EPSS is 0.21% (12th percentile), indicating very low estimated exploitation probability; the CVE is NOT on CISA KEV; and no public exploit or PoC reference is present in the supplied data. The vuln.today decision label is 'this_month', which is a routine-patch cadence rather than act_now or emergency. The one point worth noting is that the vector requires authentication (PR:L) yet the disclosure is reachable over the network via forceful browsing, so the practical risk is an authenticated low-privilege user viewing data they should not - not anonymous mass exploitation. No conflicting signals were observed; the CVSS severity, EPSS, KEV absence, and decision label all point the same direction.

An authenticated low-privilege user on a Drupal site running the affected TFA / Passwordless Login module directly requests a resource or endpoint whose access controls are not properly enforced (forceful browsing), causing the application to return sensitive information in the response. No public exploit code or PoC reference is identified in the available data, and the specific sensitive data exposed is not detailed in the sources.