CVE-2025-31681

The Drupal Authenticator Login module (versions 0.0.0 through 2.0.5) is vulnerable to a Missing Authorization flaw. Due to improper authorization checks on custom paths, an attacker can perform forceful browsing to access restricted functionality or another user's two-factor authentication config...

CVE-2025-8995

The Drupal Authenticator Login module (versions 0.0.0 through 2.1.3 ) is vulnerable to an Authentication Bypass Using an Alternate Path or Channel . The root cause is that the module fails to sufficiently validate authentication under specific conditions when using AJAX callbacks to handle the au...

CVE-2025-8093

The Drupal Authenticator Login module (versions 0.0.0 through 2.1.8 ) is vulnerable to an authentication bypass because the module fails to protect all possible login paths provided by Drupal core modules. An attacker can exploit this by utilizing an alternate path or channel to bypass the two-fa...