—
DRUPAL-CONTRIB-2025-055
Details
The module enables you to add second-factor authentication in addition to the default Drupal login.
The module doesn't sufficiently protect certain sensitive routes, allowing an attacker to view or modify various TFA-related settings.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/miniorange_2fa
Introduced in:
0Fixed in: 4.7.0Upgrade drupal/miniorange_2fa to 4.7.0 or newer (ecosystem packagist:https://packages.drupal.org/8).