Security Flaw in Drupal aLogin Module: Inadequate Protection for Login Paths
Summary
DRUPAL-CONTRIB-2025-098: This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. Affects drupal/alogin versions < 2.1.8. Fixed in 2.1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The aLogin module for Drupal enables users to implement two-factor authentication (2FA) using authenticator apps, enhancing login security. It is designed to provide an additional layer of protection during the login process, ensuring that only authorized users can access sensitive areas of a website. However, this module has a critical vulnerability that fails to secure all potential login paths, leaving users exposed to unauthorized access.
Vulnerability Detail
The vulnerability arises from the aLogin module's inability to protect all login paths provided by core modules in Drupal. This oversight can lead to unauthorized access, as attackers may exploit unprotected login routes to gain entry into user accounts. The CVSS risk score for this vulnerability is 6.3, categorized as Medium, indicating a significant risk that requires immediate attention.
How To Fix
Minimum fixed version
2.1.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually review and restrict access to login paths that are not protected by the aLogin module. This may involve implementing additional security measures or using alternative authentication methods until the module is updated.
Conclusion
The aLogin module for Drupal has a significant vulnerability that compromises login security by failing to protect all login paths. Users are strongly advised to update to version 2.1.8 or later to mitigate this risk. Implementing additional security measures is recommended until the update can be performed.
See every vulnerability recorded for drupal/alogin →
FAQ
The aLogin module is a Drupal extension that allows users to set up two-factor authentication (2FA) for enhanced login security.
The vulnerability involves the module's failure to protect all login paths, potentially allowing unauthorized access to user accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing additional security measures to restrict access to unprotected login paths.
More information can be found on the Drupal security advisory page and the CVSS calculator linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/alogin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
