{"id":"CVE-2025-8093","aliases":["DRUPAL-CONTRIB-2025-098","EUVD-2025-33792","GHSA-pjrr-5qr2-gxw3"],"status":"published","title":"Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00354,"percentile":0.29409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2025-08-27T17:19:14Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/alogin","fixed_in":["2.1.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/alogin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8"}]}]}],"products":[{"vendor":"authenticator_login_project","product":"authenticator_login"},{"vendor":"drupal","product":"authenticator login"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-098","tags":["Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8093","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pjrr-5qr2-gxw3"},{"url":"https://git.drupalcode.org/project/alogin","tags":["web"]},{"url":"https://www.drupal.org/project/alogin","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8093.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-8093","title":"Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.","status":"published","published":"2025-10-10T22:23:57.718Z","modified":"2025-10-15T13:44:54.979Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:38.025852Z"}],"euvd":[{"id":"EUVD-2025-33792","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.","status":"published","published":"2025-10-10T22:23:57Z","modified":"2025-10-15T13:44:54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:31.584227Z"}],"ghsa":[{"id":"GHSA-pjrr-5qr2-gxw3","title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator...","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.","status":"published","published":"2025-10-11T00:30:18Z","modified":"2025-10-15T15:31:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:04:00.063131Z"}],"nvd":[{"id":"CVE-2025-8093","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.","status":"published","published":"2025-10-10T23:15:36.88Z","modified":"2026-10-08T13:10:00.2Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:11:36.851295Z"}],"osv":[{"id":"CVE-2025-8093","title":"Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.","status":"published","published":"2025-10-10T22:23:57.718Z","modified":"2026-10-28T02:30:54.245433215Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DRUPAL-CONTRIB-2025-098","description":"This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security.\n\nThe module did not protect all possible login paths provided by core modules.\n\n**CVSS risk score ([experimental](https://www.drupal.org/project/securitydrupalorg/issues/3442181)) 6.3 / Medium**\n\n[CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N)","status":"published","published":"2025-08-27T17:19:14Z","modified":"2026-09-10T03:45:03.233816199Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}