CVE-2025-31681: Drupal Authenticator Login Missing Authorization Vulnerability
Summary
CVE-2025-31681: Drupal Authenticator Login Missing Authorization vulnerability. Affects drupal/alogin versions < 2.0.6. Fixed in 2.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal Authenticator Login is a package that provides authentication capabilities for Drupal applications. It allows users to log in securely and manage their sessions. However, prior to version 2.0.6, the package was susceptible to a Missing Authorization vulnerability, which could lead to unauthorized access and forceful browsing.
Vulnerability Detail
The Missing Authorization vulnerability in Drupal Authenticator Login arises from inadequate authorization checks, allowing attackers to exploit the system by accessing restricted areas without proper permissions. This flaw can lead to unauthorized data exposure and manipulation, posing a significant risk to the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
2.0.6
This is the first release that contains the fix.
composer require drupal/alogin:2.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to sensitive areas of your application by implementing additional access controls or by disabling the Authenticator Login module until the package is updated.
Conclusion
The Missing Authorization vulnerability in Drupal Authenticator Login poses a significant risk to applications using this package. It is crucial to update to version 2.0.6 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/alogin →
FAQ
The impact includes unauthorized access to restricted areas of the application, which can lead to data breaches and manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, consider implementing additional access controls as a temporary measure.
Yes, the vulnerability affects versions from 0.0.0 up to, but not including, 2.0.6.
More information can be found in the official advisory on GitHub or by checking the CVE details.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/alogin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
