Two-factor Authentication vulnerabilities

3 known vulnerabilities in Two-factor Authentication from Two-factor Authentication Project. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Two-factor Authentication (TFA): Authentication Bypass Using an Alternate Path or Channel

  CVE-2025-31694Mar 31, 2025Drupal

  Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

• 9.8 Critical severity

  Two-factor Authentication (TFA): Session Fixation

  CVE-2024-13279Jan 9, 2025Drupal

  Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.

• 9.8 Critical severity

  Two-factor Authentication (TFA): Weak Authentication

  CVE-2024-13239Jan 9, 2025Drupal

  Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.