CVE-2025-31694

The Drupal Two-factor Authentication (TFA) module is vulnerable to an incorrect authorization flaw, which allows for Forceful Browsing . This security issue affects all versions from 0.0.0 before 1.10.0 . The vulnerability is categorized under CWE-288 , identifying it as an authentication bypass ...

CVE-2024-13239

The Drupal Two-factor Authentication (TFA) module is vulnerable to a Weak Authentication flaw, which allows for Authentication Abuse . This issue specifically affects versions from 0.0.0 before 1.5.0 . The vulnerability arises from deficiencies in the authentication process, which can be exploite...

CVE-2024-13279

The Drupal Two-factor Authentication (TFA) module (versions prior to 1.8.0 ) is vulnerable to Session Fixation due to improper session management. Specifically, the module fails to sufficiently migrate sessions before prompting for a second factor token. A successful exploit could allow a malicio...

CVE-2025-7030

The Drupal Two-factor Authentication (TFA) module is vulnerable to Privilege Defined With Unsafe Actions (CWE-267) in versions prior to 1.11.0 . The root cause is improperly defined permissions that allow for incorrect access control. Specifically, the module fails to sufficiently prevent users w...