{"id":"CVE-2025-31681","aliases":["DRUPAL-CONTRIB-2025-009","EUVD-2025-9036","GHSA-jwpx-6c4p-q4jq"],"status":"published","title":"Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009","description":"Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00434,"percentile":0.38159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2025-01-29T16:54:02Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Packagist","package":"drupal/alogin","fixed_in":["2.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/alogin","fixed_in":["2.0.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/alogin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/alogin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/alogin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}]}],"products":[{"vendor":"authenticator_login_project","product":"authenticator_login"},{"vendor":"drupal","product":"authenticator login"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-009","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31681","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jwpx-6c4p-q4jq"},{"url":"https://git.drupalcode.org/project/alogin","tags":["web","package"]},{"url":"https://www.drupal.org/project/alogin","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31681.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31681","title":"Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009","description":"Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.","status":"published","published":"2025-03-31T21:39:50.247Z","modified":"2025-04-29T15:37:04.473Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:44.763463Z"}],"euvd":[{"id":"EUVD-2025-9036","description":"Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.","status":"published","published":"2025-03-31T21:39:50Z","modified":"2025-04-29T15:37:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-jwpx-6c4p-q4jq","title":"Drupal Authenticator Login Missing Authorization vulnerability","description":"Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing. This issue affects Authenticator Login: from 0.0.0 before 2.0.6.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-04-29T20:18:55Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31681","description":"Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.","status":"published","published":"2025-03-31T22:15:20.663Z","modified":"2026-06-17T09:10:45.767Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-31681","title":"Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009","description":"Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.","status":"published","published":"2025-03-31T21:39:50.247Z","modified":"2026-10-28T02:31:05.409968577Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-jwpx-6c4p-q4jq","title":"Drupal Authenticator Login Missing Authorization vulnerability","description":"Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing. This issue affects Authenticator Login: from 0.0.0 before 2.0.6.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-12-10T23:41:19.864509Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"DRUPAL-CONTRIB-2025-009","description":"This module allows a site to setup two factor authentication via QR code using authenticator applications on mobile devices including phones.\n\nThe module does not properly protect its custom paths, allowing one user to access a different user's two factor configuration.","status":"published","published":"2025-01-29T16:54:02Z","modified":"2026-09-10T03:45:06.936699028Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}