# CVE-2026-126729: Drupal Auth Login Plus two-factor authentication bypass

Source: https://junglewise.ai/threats/cve-2026-126729-drupal-contrib-2026-320-this-module-enables-you-to-require-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126729 · Severity: info · Published 2026-11-11

The Auth Login Plus module for Drupal enforces two-factor authentication (using time-based one-time passwords) for user login. However, the module does not properly enforce the second factor when users authenticate through alternative methods like HTTP Basic Authentication or REST/JSON:API endpoints. An attacker with a user's password can bypass the two-factor requirement and access the account's permissions through these alternate authentication routes.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus](https://junglewise.ai/threats/technologies/drupal-auth-login-plus). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-126729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126729 being exploited in the wild.

**How severe is CVE-2026-126729?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Drupal Auth Login Plus before 1.0.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus ECOSYSTEM:introduced=0,fixed=1.0.3.

**Is there a fix for CVE-2026-126729?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later. Until then: Mitigations include disabling per-request authentication providers (such as HTTP Basic Authentication module) and disabling alternate authentication methods (such as JSON:API or REST) if two-factor authentication is required for account security. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126729 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126729?** Check whether you run Drupal Auth Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later

Mitigations include disabling per-request authentication providers (such as HTTP Basic Authentication module) and disabling alternate authentication methods (such as JSON:API or REST) if two-factor authentication is required for account security.

## Technical details

The Auth Login Plus module fails to sufficiently enforce two-factor authentication for authentication providers that authenticate on a per-request basis (such as HTTP Basic Authentication). An attacker who possesses a valid account password can bypass the second factor requirement by using alternate authentication methods (REST, JSON:API) that do not trigger the module's two-factor enforcement logic, gaining unauthorized access to the account's permissions and resources.

## Affected products

- Drupal Auth Login Plus before 1.0.3

## Identifiers

- CVE-2026-126729
- DRUPAL-CONTRIB-2026-320

## Timeline

- 2026-11-11: disclosed

## References

- [https://www.drupal.org/u/cmlara](https://www.drupal.org/u/cmlara)
- [https://www.drupal.org/u/jurgenhaas](https://www.drupal.org/u/jurgenhaas)

## Related threats

- [Drupal Authenticator Login Plus authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-126731-drupal-contrib-2026-322-this-module-enables-you-to-require-a)
- [Drupal Authenticator Login Plus authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-126730-drupal-contrib-2026-321-this-module-enables-you-to-require-a)
- [Drupal Authenticator Login Plus improper authentication in 2FA bypass](https://junglewise.ai/threats/cve-2026-107261-drupal-contrib-2026-201-this-module-provides-totp-based-two)
- [Drupal Authenticator Login Plus TOTP bypass via one-time login link](https://junglewise.ai/threats/cve-2026-107254-drupal-contrib-2026-197-this-module-provides-totp-based-two)