Vulnerability from drupal
Published
2025-01-08 17:22
Modified
2025-06-19 22:05
Summary
Details

This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user's email every time the user tries to log in to your site.

The module did not sufficiently protect against brute force attacks, allowing an attacker to bypass the second factor.

This vulnerability is mitigated by the fact the attacker must be able to present the username and first factor (i.e. password).

Credits
Ursin Cola www.drupal.org/user/679260
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003e=2.0.0 \u003c2.0.3",
        "patched": true
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/email_tfa"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003e=2.0.0 \u003c2.0.3"
          },
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2025-31676"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/679260"
      ],
      "name": "Ursin Cola"
    }
  ],
  "details": "This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user\u0027s email every time the user tries to log in to your site.\n\nThe module did not sufficiently protect against brute force attacks, allowing an attacker to bypass the second factor.\n\nThis vulnerability is mitigated by the fact the attacker must be able to present the username and first factor (i.e. password).",
  "id": "DRUPAL-CONTRIB-2025-001",
  "modified": "2025-06-19T22:05:09.000Z",
  "published": "2025-01-08T17:22:11.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-001"
    }
  ],
  "schema_version": "1.7.0"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.