This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's...

An attacker with a valid Drupal core one-time login link for a victim's account can log in without completing the module's TOTP second factor. The flaw does not let an attacker log in without that valid link.

Look for drupal/auth_login_plus and its version in composer.lock. The advisory lists 1.0.1 as fixed but gives no affected version range. Check whether users can log in using Drupal core's one-time login links, as that is the login route where the second factor is not enforced.

The advisory identifies a limiting condition: an attacker must have access to a valid one-time login link for the victim's account.

This module provides TOTP-based two-factor authentication (2FA) for Drupal.

The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link.

This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a victim's account.