CVE-2026-107256

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0...

CVE-2026-107254

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus 2FA allows Authentication Bypass. This issue affects Authenticator Login Plus 2FA versions: from 0.0.0 to 1.0.1...

CVE-2026-107254

The Drupal Authenticator Login Plus (2FA) module (versions 0.0.0 to 1.0.1 ) contains an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288). The root cause is that the module fails to enforce the second factor when a user authenticates using a Drupal core one-time log...

EUVD-2026-113578

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus 2FA allows Authentication Bypass. This issue affects Authenticator Login Plus 2FA versions: from 0.0.0 to 1.0.1...

CVE-2026-107254 Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus 2FA allows Authentication Bypass. This issue affects Authenticator Login Plus 2FA versions: from 0.0.0 to 1.0.1...

CVE-2026-107254 Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus 2FA allows Authentication Bypass. This issue affects Authenticator Login Plus 2FA versions: from 0.0.0 to 1.0.1...

EUVD-2026-113574

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus 2FA allows Authentication Bypass. This issue affects Authenticator Login Plus 2FA versions: from 0.0.0 to 1.0.1...

CVE-2026-107261

The Authenticator Login Plus (2FA) module for Drupal is vulnerable to an Authentication Bypass Using an Alternate Path or Channel (CWE-288). This flaw may allow a user to log in using only a password, even when the site-wide enforcement of two-factor authentication (2FA) is enabled. This issue af...

CVE-2026-107261 Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus 2FA allows Authentication Bypass. This issue affects Authenticator Login Plus 2FA versions: from 0.0.0 to 1.0.1...

CVE-2026-107261 Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus 2FA allows Authentication Bypass. This issue affects Authenticator Login Plus 2FA versions: from 0.0.0 to 1.0.1...

CVE-2026-107268 Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

CVE-2026-107268

The Two Factor Authentication - TFA / Passwordless Login module for Drupal (versions 0.0.0 to 5.4.1 and 5.5.0 to 5.5.2) is vulnerable to an information disclosure flaw via its headless login endpoint. The root cause is an insertion of sensitive information into sent data where the module returns ...

CVE-2026-107268 Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

EUVD-2026-113568

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

EUVD-2026-113535

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x...

CVE-2026-114539

The DocCheck Basic module for Drupal (version 7.x ) contains an Authentication Bypass vulnerability (CWE-288). The root cause is that the module fails to sufficiently verify authentication data with the DocCheck API in certain scenarios. This flaw allows an attacker to bypass authentication mecha...

EUVD-2026-113524

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0...

CVE-2026-107256

The Shield module for Drupal (versions 0.0.0 to 1.9.0 ) is vulnerable to CWE-307: Improper Restriction of Excessive Authentication Attempts . The module fails to sufficiently limit the number of authentication attempts evaluated when an anonymous visitor repeatedly submits basic authentication cr...

CVE-2026-114572

The Domain Login Restrict module for Drupal (versions 0.0.0 to 1.5.0) is vulnerable to an Authentication Bypass (CWE-288) because it fails to sufficiently enforce login restrictions when users authenticate via methods other than the standard login form. This allows users to log in to domains they...

CVE-2026-114572 Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0...