PatchClock

PHP security digest · 7 Oct 2026

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal c...

Unrated CVE-2026-107268

Package
drupal/miniorange_2fa
Fixed in
5.4.1, 5.5.2
Published
Wed 7 Oct 2026, 17:32 LisbonUpdated Mon 26 Oct 2026, 04:25 Lisbon

In plain words

The Drupal Two Factor Authentication module can expose the site's stored miniOrange customer API key to users who are not logged in through its headless login endpoint. This requires Headless 2FA to be turned on by a user with the restricted miniorange 2fa headless permission.

Am I affected?

Look for drupal/miniorange_2fa and its version in composer.lock. The advisory lists fixes in 5.4.1 and 5.5.2, but gives no affected version ranges. Check whether Headless 2FA is turned on, and review who has the restricted miniorange 2fa headless permission that allows them to enable it.

What to do

Check which version you have, then update to a fixed release for your branch (5.4.1, 5.5.2):

composer show drupal/miniorange_2fa | grep versions
composer update drupal/miniorange_2fa

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by Headless 2FA requiring a user with the restricted miniorange 2fa headless permission to turn it on.

The advisory's description

This module enables you to add an extra layer of verification for user login flow.

The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated users.

The vulnerability is mitigated by the fact that Headless 2FA must be turned on by a user with a miniorange 2fa headless permission, which is a restricted permission.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.