AIKIDO-2026-673359
drupal/auth_login_plus is vulnerable to Improper Authentication
52
Medium Risk
This Affects:
drupal/auth_login_plusTL;DR
Authenticator Login Plus provides TOTP two-factor authentication for Drupal and can require it for every account. When site-wide enforcement is enabled, versions before 1.0.1 treat an account that enrolled and later disabled 2FA as already compliant, because the check looks for any stored secret rather than whether 2FA is currently enabled. That account can sign in with only a password and is never sent back through enrollment. The 1.0.1 fix treats a disabled enrollment as non-compliant and requires the user to set 2FA up again before a session is granted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, site-wide two-factor enforcement is enabled, and an account enrolled in 2FA and later disabled it.
Background info
drupal/auth_login_plus is vulnerable to Improper Authentication in versions 0.0.1 - 1.0.0.
How to fix this
Upgrade the drupal/auth_login_plus library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.