Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-8995: Authenticator Login permits login without valid credentials

CVE-2025-8995 · published 1 year ago

Summary

The Authenticator Login component for Drupal (versions before 2.1.4) can be tricked into letting a user log in without the correct password or other proof of identity. This means an attacker could gain the same access rights as a legitimate user and view or change site data. Upgrade to version 2.1.4 or later as soon as possible and verify that no unauthorized accounts have been created.

What to do

Update authenticator_login_project authenticator_login to version 2.1.4 or later.

Affected software

Vendor	Product	Affected versions
authenticator_login_project	authenticator_login	< 2.1.4 `cpe:2.3:a:authenticator_login_project:authenticator_login::::::drupal::*`

Original advisory text

Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.

References

https://www.drupal.org/sa-contrib-2025-096 URL
https://git.drupalcode.org/project/alogin URL
https://www.drupal.org/project/alogin URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8995.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-8995 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-288Authentication Bypass Using Alternate Path

CWE-306Missing Authentication for Critical Function

Timeline

Published15 Aug 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-8995 · NVD

CVE-2025-8995 · OSV

Track software like this

Free during beta