drupal/alogin - SA-CONTRIB-2025-096
This module enables users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. The module alters the standard Drupal login form to use AJAX callbacks for handling authentication flow.
The module doesn't sufficiently validate authentication under specific conditions, allowing an attacker to log in as any account where they know the username.
This vulnerability is mitigated by the fact that an attacker must make a series of requests to trigger the necessary conditions that allow authentication byass. The series of requests could alert a site owner that they are being attacked; however, the number of requests necessary to trigger the conditions is usually quite small (the number depends on site configuration, by default it is 5).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/alogin | < 2.1.5 | 2.1.5 |
| Drupal module | drupal/alogin | < 2.1.5 | 2.1.5 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/alogin- Disclosed
- 13.08.2025
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2025-096 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/alogin
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 01.2025 08.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Unrated 2
Disclosures per year
- 2025: 3
- 2026: 0
-
drupal/alogin - SA-CONTRIB-2025-096 this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.