CVE-2025-31681 Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009
Attackers can bypass authentication controls in the Drupal Authenticator Login plugin to access restricted resources without valid credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31681?
CVE-2025-31681 is a critical missing authorization vulnerability in Drupal Authenticator Login, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
Weakness: CWE-862
Which versions are affected by CVE-2025-31681?
2 open source packages ship an affected version, including drupal/alogin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/alogin Packagist | All versions | 2.0.6 |
drupal/alogin Packagist | All versions | 2.0.6 |
Linux distribution packages (1)
drupal/alogin Packagist:https://packages.drupal.org/8 | All versions | 2.0.6 |
Products include Authenticator Login Project Authenticator Login.
How do I fix CVE-2025-31681?
Upgrade drupal/alogin to 2.0.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-31681 being exploited?
There is no known exploitation of CVE-2025-31681 in the wild and no public exploit code.
Other vulnerabilities in Drupal Authenticator Login
Sources
Also known as DRUPAL-CONTRIB-2025-009, GHSA-jwpx-6c4p-q4jq.