drupal Two Factor Authentication - TFA / Passwordless Login vulnerabilities

Latest drupal Two Factor Authentication - TFA / Passwordless Login CVEs

Newest publication first

1. CVE-2026-107268 Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

   Published 2026-10-30

   Medium·CVSS 4.3 EPSS 0.30%

   Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.