# CVE-2026-126730: Drupal Authenticator Login Plus authentication bypass in 2FA

Source: https://junglewise.ai/threats/cve-2026-126730-drupal-contrib-2026-321-this-module-enables-you-to-require-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126730 · Severity: info · Published 2026-11-11

Authenticator Login Plus is a Drupal module that enforces two-factor authentication using time-based one-time passwords from authenticator apps. The module fails to properly verify the second factor, allowing attackers who obtain a first-factor credential (such as a valid one-time login link) to bypass the 2FA requirement and perform privileged actions like updating account details and triggering other modules' login hooks.

Technologies: [Drupal Authenticator Login Plus](https://junglewise.ai/threats/technologies/authenticator-login-plus), [Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus](https://junglewise.ai/threats/technologies/drupal-auth-login-plus). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-126730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126730 being exploited in the wild.

**How severe is CVE-2026-126730?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Drupal Authenticator Login Plus before 1.0.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus ECOSYSTEM:introduced=0,fixed=1.0.3.

**Is there a fix for CVE-2026-126730?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126730 attacked?** It is attacked from the adjacent network or with local access, in a software library.

**Am I affected by CVE-2026-126730?** Check whether you run Drupal Authenticator Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later

## Technical details

The vulnerability is an authentication bypass in the 2FA enforcement logic. An attacker with only the first authentication factor (a valid one-time login link or valid first-factor authentication through another module) can trigger actions that require full authentication, including updating the account's last login time and executing other modules' login hooks. The attack requires prior compromise of the first factor and the impact is amplified by reactions from other installed modules.

## Affected products

- Drupal Authenticator Login Plus before 1.0.3

## Identifiers

- CVE-2026-126730
- DRUPAL-CONTRIB-2026-321

## Timeline

- 2026-11-11: disclosed

## References

- [https://www.drupal.org/u/jurgenhaas](https://www.drupal.org/u/jurgenhaas)
- [https://www.drupal.org/sa-contrib-2026-321](https://www.drupal.org/sa-contrib-2026-321)

## Related threats

- [Drupal Authenticator Login Plus authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-126731-drupal-contrib-2026-322-this-module-enables-you-to-require-a)
- [Drupal Auth Login Plus two-factor authentication bypass](https://junglewise.ai/threats/cve-2026-126729-drupal-contrib-2026-320-this-module-enables-you-to-require-a)
- [Drupal Authenticator Login Plus improper authentication in 2FA bypass](https://junglewise.ai/threats/cve-2026-107261-drupal-contrib-2026-201-this-module-provides-totp-based-two)
- [Drupal Authenticator Login Plus TOTP bypass via one-time login link](https://junglewise.ai/threats/cve-2026-107254-drupal-contrib-2026-197-this-module-provides-totp-based-two)