GHSA-hf6c-fgp3-jfchhigh8.1
DRUPAL-CONTRIB-2025-023
The advisory, in context
This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.
The module does not sufficiently ensure that known login routes are not overridden by third-party modules which can allow an access bypass to occur.
This vulnerability is mitigated by the fact that an attacker must obtain a first-factor login credential.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/tfa Packagist
Ecosystem versions
Earlier releases before 1.10.0
Fixed in 1.10.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": []
}drupal/tfa Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.10.0
Fixed in 1.10.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.10.0"
}
}
],
"versions": []
}