Drupal Email TFA Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the Drupal Email TFA module, versions prior to 2.0.6. This vulnerability allows users to bypass the two-factor authentication mechanism provided by the module for email-based logins. The issue arises because the module does not fully secure all login pathways as intended. Exploitation of this vulnerability requires valid user credentials, including a username and password.

Impact

Exploitation of this vulnerability allows for unauthorized access by bypassing the two-factor authentication requirement, potentially leading to unauthorized user actions or access rights.

Remediation

Users of the Drupal Email TFA module should upgrade to version 2.0.6.