Is CVE-2026-126731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126731 being exploited in the wild.

How severe is CVE-2026-126731?

Informational severity, published 11 November 2026.

How is CVE-2026-126731 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126731?

Check whether you run Drupal Authenticator Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126731: Drupal Authenticator Login Plus authentication bypass in 2FA

CVE-2026-126731 · Severity: info · Published 2026-11-11

Authenticator Login Plus is a Drupal module that adds two-factor authentication (2FA) to user login. Under certain timing conditions, an attacker with an existing account can bypass the password check or reach another user's 2FA setup page, potentially enabling account takeover. The attack requires the attacker to already have an account, know or control the victim's email/password, and exploit a race condition.

Technologies: Drupal Authenticator Login Plus, Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126731 being exploited in the wild.
How severe is CVE-2026-126731?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Authenticator Login Plus before 1.0.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus ECOSYSTEM:introduced=0,fixed=1.0.3.
Is there a fix for CVE-2026-126731?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later. Until then: Upgrade to Authenticator Login Plus 1.0.3 or later to address this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126731 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126731?: Check whether you run Drupal Authenticator Login Plus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Auth Login Plus: upgrade to 1.0.3 or later

Upgrade to Authenticator Login Plus 1.0.3 or later to address this vulnerability.

Technical details

This authentication bypass vulnerability in the Authenticator Login Plus module (drupal/auth_login_plus) allows an attacker to make the module treat a login as having passed password verification when it did not, or to access the 2FA setup page of another account. The vulnerability is exploitable via a timing-dependent race condition and requires the attacker to have an existing account on the site and either control the victim's email address or know their password. Exploitation could result in account takeover of accounts with 2FA enabled.

Affected products

Drupal Authenticator Login Plus before 1.0.3

Identifiers

CVE-2026-126731
DRUPAL-CONTRIB-2026-322

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.