CVE-2025-31694: Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing

April 1, 2025 (updated April 29, 2025)

Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing. This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

References

git.drupalcode.org/project/tfa
github.com/advisories/GHSA-hf6c-fgp3-jfch
nvd.nist.gov/vuln/detail/CVE-2025-31694
www.drupal.org/sa-contrib-2025-023

Code Behaviors & Features

Detect and mitigate CVE-2025-31694 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →