# CVE-2026-107268: Drupal miniorange_2fa API key disclosure in headless endpoint

Source: https://junglewise.ai/threats/cve-2026-107268-drupal-contrib-2026-207-this-module-enables-you-to-add-an-extra  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

CVE-2026-107268 · Severity: info · Published 2026-10-30

The miniOrange Two Factor Authentication module for Drupal, which provides additional login security, contains a vulnerability in its headless login feature that can expose the site's miniOrange API credentials to unauthenticated users. An attacker could use the disclosed API key to impersonate the site or abuse the authentication service. The risk is reduced because this feature must be explicitly enabled by an administrator.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange 2fa](https://junglewise.ai/threats/technologies/drupal-miniorange-2fa). Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-107268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107268 being exploited in the wild.

**How severe is CVE-2026-107268?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** miniOrange Two Factor Authentication - TFA / Passwordless Login <5.4.1, 5.5.0 to 5.5.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange 2fa ECOSYSTEM:introduced=0,fixed=5.4.1|ECOSYSTEM:introduced=5.5.0,fixed=5.5.2.

**Is there a fix for CVE-2026-107268?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange 2fa: upgrade to 5.4.1 or later. Until then: Ensure that the Headless 2FA feature is not enabled unless required, as this restricts the vulnerability to sites where the feature has been explicitly activated by an administrator with appropriate permissions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107268 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107268?** Check whether you run miniOrange Two Factor Authentication - TFA / Passwordless Login or Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange 2fa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Miniorange 2fa: upgrade to 5.4.1 or later

Ensure that the Headless 2FA feature is not enabled unless required, as this restricts the vulnerability to sites where the feature has been explicitly activated by an administrator with appropriate permissions.

## Technical details

The headless login endpoint in the miniorange_2fa Drupal module leaks the stored miniOrange customer API key to unauthenticated requests. The vulnerability affects versions below 5.4.1 and versions 5.5.0 to 5.5.1. While the headless 2FA feature requires admin enablement, any unauthenticated user can trigger the disclosure once it is active, gaining unauthorized access to API credentials.

## Affected products

- miniOrange Two Factor Authentication - TFA / Passwordless Login <5.4.1, 5.5.0 to 5.5.1

## Identifiers

- CVE-2026-107268
- DRUPAL-CONTRIB-2026-207

## Timeline

- 2026-10-07: disclosed

## References

- [https://www.drupal.org/u/yuwkaa](https://www.drupal.org/u/yuwkaa)
- [https://www.drupal.org/sa-contrib-2026-207](https://www.drupal.org/sa-contrib-2026-207)

## Related threats

- [DRUPAL-CONTRIB-2025-082 - The module enables you to add second-factor authentication on top of the default Drupal…](https://junglewise.ai/threats/cve-2025-6675-drupal-contrib-2025-082-the-module-enables-you-to-add-second)
- [DRUPAL-CONTRIB-2025-056 - The module enables you to add second-factor authentication in addition to the default Drupal…](https://junglewise.ai/threats/cve-2025-47710-drupal-contrib-2025-056-the-module-enables-you-to-add-second)
- [DRUPAL-CONTRIB-2025-055 - The module enables you to add second-factor authentication in addition to the default Drupal…](https://junglewise.ai/threats/cve-2025-47709-drupal-contrib-2025-055-the-module-enables-you-to-add-second)
- [DRUPAL-CONTRIB-2025-054 - The module enables you to add second-factor authentication in addition to the default Drupal…](https://junglewise.ai/threats/cve-2025-47708-drupal-contrib-2025-054-the-module-enables-you-to-add-second)
- [DRUPAL-CONTRIB-2025-053 - The module enables you to add second-factor authentication in addition to the default Drupal…](https://junglewise.ai/threats/cve-2025-47707-drupal-contrib-2025-053-the-module-enables-you-to-add-second)