Quick answers
- Is CVE-2026-126730 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126730 being exploited in the wild.
- How severe is CVE-2026-126730?
- Informational severity, published 11 November 2026.
- Which products and versions are affected?
- Drupal Authenticator Login Plus before 1.0.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus ECOSYSTEM:introduced=0,fixed=1.0.3.
- Is there a fix for CVE-2026-126730?
- Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-126730 attacked?
- It is attacked from the adjacent network or with local access, in a software library.
- Am I affected by CVE-2026-126730?
- Check whether you run Drupal Authenticator Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later
Technical details
The vulnerability is an authentication bypass in the 2FA enforcement logic. An attacker with only the first authentication factor (a valid one-time login link or valid first-factor authentication through another module) can trigger actions that require full authentication, including updating the account's last login time and executing other modules' login hooks. The attack requires prior compromise of the first factor and the impact is amplified by reactions from other installed modules.
Affected products
- Drupal Authenticator Login Plus before 1.0.3
Identifiers
- CVE-2026-126730
- DRUPAL-CONTRIB-2026-321
Timeline
- 2026-11-11: disclosed