Two-factor Authentication Project
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Two-factor Authentication Project records in CISA KEVNo Two-factor Authentication Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 50
Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00576 · Published 2025-01-09 · Fixed in 1.5.0 CWE-1390
Priority MEDIUM 49
Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00472 · Published 2025-01-09 · Fixed in 1.8.0 CWE-384
Priority LOW 37
Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.004 · Published 2025-03-31 · Fixed in 1.10.0 CWE-288
Priority LOW 29
Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): fr…
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00412 · Published 2025-07-08 · Fixed in 1.11.0 CWE-267
THREATIST.IORead the docs