CVE-2026-126729: Drupal Auth Login Plus two-factor authentication bypass

CVE-2026-126729 · Severity: info · Published 2026-11-11

The Auth Login Plus module for Drupal enforces two-factor authentication (using time-based one-time passwords) for user login. However, the module does not properly enforce the second factor when users authenticate through alternative methods like HTTP Basic Authentication or REST/JSON:API endpoints. An attacker with a user's password can bypass the two-factor requirement and access the account's permissions through these alternate authentication routes.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126729 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126729 being exploited in the wild.
How severe is CVE-2026-126729?
Informational severity, published 11 November 2026.
Which products and versions are affected?
Drupal Auth Login Plus before 1.0.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus ECOSYSTEM:introduced=0,fixed=1.0.3.
Is there a fix for CVE-2026-126729?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later. Until then: Mitigations include disabling per-request authentication providers (such as HTTP Basic Authentication module) and disabling alternate authentication methods (such as JSON:API or REST) if two-factor authentication is required for account security. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126729 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126729?
Check whether you run Drupal Auth Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later

Mitigations include disabling per-request authentication providers (such as HTTP Basic Authentication module) and disabling alternate authentication methods (such as JSON:API or REST) if two-factor authentication is required for account security.

Technical details

The Auth Login Plus module fails to sufficiently enforce two-factor authentication for authentication providers that authenticate on a per-request basis (such as HTTP Basic Authentication). An attacker who possesses a valid account password can bypass the second factor requirement by using alternate authentication methods (REST, JSON:API) that do not trigger the module's two-factor enforcement logic, gaining unauthorized access to the account's permissions and resources.

Affected products

  • Drupal Auth Login Plus before 1.0.3

Identifiers

  • CVE-2026-126729
  • DRUPAL-CONTRIB-2026-320

Timeline

  • 2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.