Two Factor Authentication Tfa Passwordless Login
Monthly
Forceful browsing in the Drupal contributed module Two Factor Authentication - TFA / Passwordless Login lets an authenticated, low-privileged user reach module resources directly and receive sensitive information that should have been protected by access checks (CWE-201). Rated CVSS 4.3 with confidentiality-only impact, it affects releases before 5.4.1 and 5.5.0 through 5.5.1 on Drupal sites that have the module installed. No public exploit identified at time of analysis, there is no CISA KEV entry, and EPSS is 0.21% (12th percentile); vendor patches are available in 5.4.1 and 5.5.2.
Forceful browsing in the Drupal contributed module Two Factor Authentication - TFA / Passwordless Login lets an authenticated, low-privileged user reach module resources directly and receive sensitive information that should have been protected by access checks (CWE-201). Rated CVSS 4.3 with confidentiality-only impact, it affects releases before 5.4.1 and 5.5.0 through 5.5.1 on Drupal sites that have the module installed. No public exploit identified at time of analysis, there is no CISA KEV entry, and EPSS is 0.21% (12th percentile); vendor patches are available in 5.4.1 and 5.5.2.