PatchClock

PHP security digest · 7 Oct 2026

This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may all...

Unrated CVE-2026-107261

Package
drupal/auth_login_plus
Fixed in
1.0.1
Published
Wed 7 Oct 2026, 17:23 LisbonUpdated Mon 26 Oct 2026, 04:25 Lisbon

In plain words

The module may let a user log in with only a password even when site-wide two-factor authentication (2FA) enforcement is turned on. This can bypass the requirement for a second authentication factor.

Am I affected?

Find drupal/auth_login_plus and its version in composer.lock. The advisory lists 1.0.1 as fixed but does not specify the affected version range. Check whether the module's optional site-wide 2FA enforcement setting is turned on, as this is the condition described.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.1):

composer show drupal/auth_login_plus | grep versions
composer update drupal/auth_login_plus

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide.

The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.