Authenticator Login Plus 2Fa
Monthly
Authentication bypass in the Drupal contributed module Authenticator Login Plus (2FA), affecting versions 0.0.0 through 1.0.1, lets remote unauthenticated attackers defeat the module's second-factor enforcement by reaching an alternate path or channel (CWE-288). Only Drupal sites that have this specific contributed module installed and enabled at a vulnerable version are exposed; the second factor must actually be relied upon for the bypass to have meaningful impact. Impact is partial (confidentiality and integrity low, availability none) and the CVSS vector rates attack complexity High, so a condition outside the attacker's control must hold for a successful bypass; EPSS is low at 0.19% (9th percentile) and no public exploit has been identified at time of analysis, though the vendor's 'this_month' priority means it should be scheduled rather than deferred indefinitely.
Two-factor authentication bypass in the Drupal contrib module Authenticator Login Plus (2FA) affects sites running versions 0.0.0 through 1.0.1 where the module is enabled and 2FA is relied upon as a control. An authenticated attacker with low-level privileges-consistent with already holding valid first-factor credentials-can use an alternate path or channel to bypass the second factor over the network without user interaction, though high attack complexity means conditions outside the attacker's control must be met. Impact is limited to low confidentiality and integrity; no public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile).
Authentication bypass in the Drupal contributed module Authenticator Login Plus (2FA), affecting versions 0.0.0 through 1.0.1, lets remote unauthenticated attackers defeat the module's second-factor enforcement by reaching an alternate path or channel (CWE-288). Only Drupal sites that have this specific contributed module installed and enabled at a vulnerable version are exposed; the second factor must actually be relied upon for the bypass to have meaningful impact. Impact is partial (confidentiality and integrity low, availability none) and the CVSS vector rates attack complexity High, so a condition outside the attacker's control must hold for a successful bypass; EPSS is low at 0.19% (9th percentile) and no public exploit has been identified at time of analysis, though the vendor's 'this_month' priority means it should be scheduled rather than deferred indefinitely.
Two-factor authentication bypass in the Drupal contrib module Authenticator Login Plus (2FA) affects sites running versions 0.0.0 through 1.0.1 where the module is enabled and 2FA is relied upon as a control. An authenticated attacker with low-level privileges-consistent with already holding valid first-factor credentials-can use an alternate path or channel to bypass the second factor over the network without user interaction, though high attack complexity means conditions outside the attacker's control must be met. Impact is limited to low confidentiality and integrity; no public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile).