Authenticator Login
Monthly
Second-factor authentication bypass in the Drupal Authenticator Login contrib module (versions before 2.1.8) allows an attacker who already possesses valid primary credentials for a target account to reach authenticated access without completing the module's two-factor challenge. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is remotely reachable with low privileges and no user interaction, but impact is bounded to accounts whose first-factor credentials the attacker can already supply, and only sites with this specific contrib module installed and enabled are exposed. No public exploit code has been identified at time of analysis, EPSS is low at 0.35% (26th percentile), and the vendor has released a fix, making this a mid-tier operational priority rather than an emergency.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.0.0 before 2.1.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.0.0 before 2.0.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Second-factor authentication bypass in the Drupal Authenticator Login contrib module (versions before 2.1.8) allows an attacker who already possesses valid primary credentials for a target account to reach authenticated access without completing the module's two-factor challenge. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is remotely reachable with low privileges and no user interaction, but impact is bounded to accounts whose first-factor credentials the attacker can already supply, and only sites with this specific contrib module installed and enabled are exposed. No public exploit code has been identified at time of analysis, EPSS is low at 0.35% (26th percentile), and the vendor has released a fix, making this a mid-tier operational priority rather than an emergency.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.0.0 before 2.1.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.0.0 before 2.0.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.