PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107261 Drupal CVE debrief

The CVE-2026-107261 debrief is based on the supplied source corpus. The CVE record was published on 2026-10-07T16:23:53.000Z and has not been modified since then. This vulnerability affects the auth_login_plus module for Drupal, which provides TOTP-based two-factor authentication with an optional setting to enforce 2FA for all users site-wide. However, the module may allow users to log in with only a password even when site-wide 2FA enforcement is enabled. Site administrators and security teams must verify 2FA configuration, assess exposure, and update the module to prevent unauthorized access.

Vendor
Drupal
Product
auth_login_plus
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-07
Original CVE updated
2026-10-07
Advisory published
2026-10-07
Advisory updated
2026-10-07

Who should care

Drupal site administrators and security teams responsible for 2FA configuration and user authentication. They should assess exposure, verify 2FA enforcement, and update the auth_login_plus module to version 1.0.1 or later. Additionally, they should monitor user authentication and 2FA usage to prevent potential security breaches.

Why it matters

CVE-2026-107261 allows users to bypass 2FA enforcement in the auth_login_plus module for Drupal. Site administrators and security teams must verify 2FA configuration, assess exposure, and update the module to prevent unauthorized access.

  • Verify 2FA configuration and enforcement in the auth_login_plus module
  • Assess exposure of Drupal sites to 2FA bypass
  • Update the auth_login_plus module to version 1.0.1 or later
  • Monitor user authentication and 2FA usage

Technical summary

The auth_login_plus module provides TOTP-based two-factor authentication for Drupal. An optional setting enforces 2FA for all users site-wide. However, the module may allow users to log in with only a password when site-wide 2FA enforcement is enabled.

Defensive priority

Drupal site administrators and security teams should assess exposure and verify 2FA enforcement.

Recommended defensive actions

  • Verify 2FA enforcement in the auth_login_plus module
  • Assess exposure of Drupal sites using the auth_login_plus module
  • Update the auth_login_plus module to version 1.0.1 or later

Evidence notes

The module provides TOTP-based two-factor authentication for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user to log in with only a password even when site-wide enforcement of 2FA is turned on.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107261 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107261

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107261 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107261

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • DRUPAL-CONTRIB-2026-201

    Unverified legacy reference

    URL: https://storage.googleapis.com/osv-vulnerabilities/Packagist/DRUPAL-CONTRIB-2026-201.json

    osv_dev

  • Source reference

    Unverified legacy reference

    URL: https://www.drupal.org/sa-contrib-2026-201

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.