CVE-2025-31681

The Drupal Authenticator Login module (versions 0.0.0 through 2.0.5) is vulnerable to a Missing Authorization flaw (CWE-862). Due to improper authorization checks within the component, an attacker can perform Forceful Browsing to access restricted functionality or resources without proper permiss...

CVE-2025-8995

The Drupal Authenticator Login module (versions 0.0.0 through 2.1.3 ) is vulnerable to an Authentication Bypass Using an Alternate Path or Channel . The root cause is that the module fails to sufficiently validate authentication under specific conditions when using AJAX callbacks to handle the au...

CVE-2025-8093

The Drupal Authenticator Login module (versions prior to 2.1.8 ) is vulnerable to an authentication bypass using an alternate path or channel. The root cause is that the module failed to protect all possible login paths provided by core modules. This vulnerability could allow attackers to bypass ...