Is CVE-2026-107261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107261 being exploited in the wild.

How severe is CVE-2026-107261?

Informational severity, published 30 October 2026.

How is CVE-2026-107261 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107261?

Check whether you run Drupal Authenticator Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107261: Drupal Authenticator Login Plus improper authentication in 2FA bypass

CVE-2026-107261 · Severity: info · Published 2026-10-30

Authenticator Login Plus is a Drupal module that enforces time-based one-time password (TOTP) two-factor authentication across a website. The module contains a flaw that allows users to bypass site-wide 2FA enforcement and log in with only a password, defeating the intended authentication requirement and potentially granting unauthorized account access.

Technologies: Drupal Authenticator Login Plus, Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-107261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107261 being exploited in the wild.
How severe is CVE-2026-107261?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Drupal Authenticator Login Plus before 1.0.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus ECOSYSTEM:introduced=0,fixed=1.0.1.
Is there a fix for CVE-2026-107261?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.1 or later. Until then: After upgrading to version 1.0.1, users who previously disabled 2FA will be required to set it up again at their next login. Administrators can also manually re-enable 2FA for specific users from the admin interface to ensure existing authenticators are preserved.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107261 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107261?: Check whether you run Drupal Authenticator Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.1 or later

After upgrading to version 1.0.1, users who previously disabled 2FA will be required to set it up again at their next login. Administrators can also manually re-enable 2FA for specific users from the admin interface to ensure existing authenticators are preserved.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07"}]

Technical details

The module fails to properly enforce TOTP-based two-factor authentication when site-wide enforcement is enabled, allowing password-only login to succeed in violation of the security policy. This is an improper authentication vulnerability affecting versions prior to 1.0.1. An authenticated attacker or user could exploit this during login to gain unauthorized session access without providing the required second factor.

Affected products

Drupal Authenticator Login Plus before 1.0.1

Identifiers

CVE-2026-107261
DRUPAL-CONTRIB-2026-201

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.