CVE-2026-107268
Medium · 4.3CVSS
4.3
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. CWE-201
- CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. CWE-201
- CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information exposure… CWE-201
- CVE-2026-45049 Open Access Management (OpenAM) is an access management solution. CWE-201
- CVE-2026-48200 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document… CWE-201
- CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. CWE-201
- CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data… CWE-201
- CVE-2026-115591 Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form… CWE-201