—
DRUPAL-CONTRIB-2025-052
Details
The module enables you to add second-factor authentication in addition to the default Drupal login.
The module doesn't sufficiently check whether the TOTP token is already used or not for authenticator-based second-factor methods.
This vulnerability is mitigated by the fact that an attacker must have a username, password and TOTP token generated within the last 5 minutes.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/miniorange_2fa
Introduced in:
0Fixed in: 4.7.0Upgrade drupal/miniorange_2fa to 4.7.0 or newer (ecosystem packagist:https://packages.drupal.org/8).