CVE-2025-47706

🗓️ 14 May 2025 17:02:44Reported by drupalType

Authentication bypass vulnerability in Drupal Enterprise Multi-Factor Authentication allows remote access.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-47706	14 May 202517:32	–	circl
CNNVD	Drupal Enterprise MFA - TFA for Drupal 安全漏洞	14 May 202500:00	–	cnnvd
Cvelist	CVE-2025-47706 Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052	14 May 202517:02	–	cvelist
Drupal	Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052	7 May 202500:00	–	drupal
EUVD	EUVD-2025-14924	3 Oct 202520:07	–	euvd
NVD	CVE-2025-47706	14 May 202517:15	–	nvd
OSV	CVE-2025-47706	14 May 202517:15	–	osv
OSV	DRUPAL-CONTRIB-2025-052	7 May 202517:07	–	osv
Patchstack	Drupal Enterprise MFA - TFA for Drupal module < 4.7.0,5.0.0-5.1.0 - Unauthenticated Broken Access Control vulnerability	7 May 202500:00	–	patchstack
Positive Technologies	PT-2025-21194 · Drupal · Enterprise Mfa - Tfa For Drupal	14 May 202500:00	–	ptsecurity

NVD

Node

miniorange miniorange_2faRange5.0.0–5.2.0drupal

miniorange miniorange_2faRange7.x-2.16–8.x-4.7drupal

[
  {
    "collectionURL": "https://www.drupal.org/project/miniorange_2fa",
    "defaultStatus": "unaffected",
    "product": "Enterprise MFA - TFA for Drupal",
    "repo": "https://git.drupalcode.org/project/miniorange_2fa",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThan": "4.7.0",
        "status": "affected",
        "version": "0.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.2.0",
        "status": "affected",
        "version": "5.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
drupal	www.drupal.org/sa-contrib-2025-052

10 Jun 2025 15:26Current

7.2High risk

Vulners AI Score7.2

CVSS 3.14.8

EPSS0.00126

SSVC

CWE-294