Introduction
On Drupal sites that run the Authenticator Login module, attackers can bypass two-factor authentication through alternate access paths and gain unauthorized access to any account. That directly undermines a control organizations rely on to stop credential-based attacks. The flaw has a critical CVSS score of 9.8 and affects all versions from 0.0.0 up to but not including 2.1.4.
Drupal is an open-source content management system that runs millions of websites, from small businesses to large enterprises and government agencies. The Authenticator Login module is a popular contributed extension that adds two-factor authentication through authenticator apps, and many Drupal deployments depend on it for login security.
Technical Information
CVE-2025-8995 is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel. In the Drupal Authenticator Login module, the controller methods that handle user-specific two-factor authentication configuration paths have missing or inadequate authorization checks.
The affected routes do not enforce the required _permission or _access constraints, and the controller methods may not validate the user context properly. A remote attacker can call these endpoints directly and access or modify the 2FA settings of any user account. This bypasses both primary and secondary authentication, so two-factor authentication no longer provides the protection it was meant to.
The attack works over the network and needs no elevated privileges or user interaction. An attacker sends requests to endpoints that should be restricted but are misconfigured, then disables or reconfigures 2FA for any user. No public code snippets are available, but the pattern matches issues seen before in other Drupal authentication modules.
Patch Information
The Mail Login module for Drupal lets users log in with their email addresses. A critical vulnerability was found in its brute force protection, which was incomplete and could let attackers get past those protections and gain unauthorized access to user accounts.
The module maintainers released versions with stronger brute force protection:
- For the 3.x branch, upgrade to Mail Login 3.2.0.
- For the 4.x branch, upgrade to Mail Login 4.2.0.
These releases add stronger flood control, in line with Drupal core's standards. Site administrators who upgrade to them get a login process protected against brute force attacks.
Patch source: https://www.drupal.org/sa-contrib-2025-088
Detection Methods
Finding vulnerabilities in a Drupal installation takes both automated tools and manual inspection. The following tools and methods can help identify security issues in your site:
1. Automated Security Modules:
-
MD5 Check: Generates an MD5 checksum for every file in a module. If a file is altered, the module issues a security warning so administrators know about the unauthorized change.
-
File Integrity Check: Compares the current state of your Drupal installation against a file of MD5 hashes from an official Drupal release, and detects missing, changed, or unknown files that may indicate tampering.
-
Security Scanner Component for SimpleTest Module: Uses Drupal's SimpleTest capabilities to run automated tests for vulnerabilities such as SQL Injection and Cross-Site Scripting (XSS).
-
PHPIDS: Integrates the PHP Intrusion Detection System, which logs and monitors potential attacks by analyzing user input and behavior.
2. Vulnerability Assessment Tools:
-
Security Testing Module: Designed to find XSS, CSRF, and SQL Injection vulnerabilities in contributed modules. It scans source code, then tries to exploit what it finds with automated tests.
-
Vulnerability Checker: Lists every composer package, library, module, theme, and server package your Drupal installation uses, and checks each one for vulnerabilities against sources including packagist.org and the National Vulnerability Database.
3. Antivirus and Malware Detection:
- Drupal Antivirus Site Protection: Scans all files on your Drupal site, including theme files, module files, and upload directories, to detect and remove malicious code such as backdoors, rootkits, trojans, worms, and spyware.
4. Continuous Monitoring and Reporting:
-
Update Status: Part of Drupal core since version 6. It checks regularly for updates, including security patches, so your site stays protected against known vulnerabilities.
-
Security Report: Analyzes your Drupal installation and produces a Security Information Report (SIR) on your site's security status.
5. Manual Code Reviews and Best Practices:
- Coder Module: A developer tool for code review and version upgrades. Its security vulnerability checks help developers follow best practices and catch issues during development.
6. External Vulnerability Scanning Services:
- Scalable CyberSec Module: Connects to external cybersecurity services to scan your Drupal site for vulnerabilities, and returns reports with remediation guidance.
7. Community and Security Advisories:
- Drupal Security Advisories: The Drupal Security Team publishes advisories on known vulnerabilities and recommended actions. Reviewing them regularly keeps you informed.
Detection sources: https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/detection-and-prevention, https://www.drupal.org/project/securitytesting, https://www.drupal.org/project/drupal_antivirus, https://www.drupal.org/project/vulnerability_checker, https://www.drupal.org/project/scalable_cybersec, https://www.drupal.org/security
Affected Systems and Versions
- Product: Drupal Authenticator Login module
- Affected versions: 0.0.0 up to but not including 2.1.4
- All configurations using these versions are vulnerable
Vendor Security History
- Similar vulnerabilities have been reported in other Drupal authentication modules, including CVE-2025-31681 and CVE-2025-31694. Both involve missing authorization checks on user-specific 2FA configuration paths.
- [email protected] maintains the Authenticator Login module, which has a history of regular updates. This incident shows that authentication-related contributed modules need more rigorous security review.
- Drupal's core security team coordinates advisories and patches, but contributed modules have a history of problems with access control and authentication security.
